TLDR Tech / InfoSec
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)
A single unauthenticated POST to /%6a_security_check mints an admin session on Cisco SD-WAN vManage through CVE-2026-76504, a critical authentication bypass Cisco disclosed on September 30 as an exploited zero-day. Cisco's login module checked the raw request URI while WildFly matched the decoded path, so the encoded request skipped the password check and fell into a session-continuation branch that trusted hardcoded internal usernames like viptela-reserved-cloudops. With ~1,500 vManage instances internet-exposed per VulnCheck, defenders should follow Cisco's advisory and hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check paths and viptela-reserved- usernames.
Read the full story