CVE-2026-76504 / Cisco CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Recommended actionPatch only the product branches with a verified fix

CISA confirms exploitation in the wild and lists 2026-10-03 as the remediation due date. Verified remediation exists for at least one product or source, but 401 structured product or package states remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Fix availability varies by product

What, why and how

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

What

Why

The product does not properly handle when all or part of an input has been URL encoded.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Why

The product does not properly handle when all or part of an input has been URL encoded.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

Confirmed in the wild

CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2026-09-30.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: a network path → Improper Handling of URL Encoding (Hex Encoding) → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Network
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-177 ↗
CWE-177: Improper Handling of URL Encoding (Hex Encoding). The product does not properly handle when all or part of an input has been URL encoded.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

NetworkUnauthenticatedCWE-177CISA KEV

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2026-89950Known-exploited evidence recorded

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Official EUVD record ↗

BSI · German · WID-SEC-2026-3681Cisco Catalyst SD-WAN Manager: Schwachstelle ermöglicht Erlangen von Administratorrechten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Catalyst SD-WAN Manager ausnutzen, um die Authentifizierung zu umgehen und Administratorrechte zu erlangen.

Official advisory ↗

Canadian Centre for Cyber Security · English · AV26-978Cisco security advisory (AV26-978)

As of September 30, 2026, Cisco is affected by a vulnerability in the following product: On September 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to their Known Exploited Vulnerabilities (KEV) Database.

Official advisory ↗

Cyber Security Agency of Singapore · English · CSA-SB-20261007Security Bulletin 7 Oct 2026

The Cyber Security Agency of Singapore included this CVE in its official Security Bulletin 7 Oct 2026, published on 7 October 2026. Open the linked bulletin for the product, severity and reference information published in that issue.

Official advisory ↗

INCIBE-CERT · Spanish · omision-de-autenticacion-en-catalyst-sd-wan-manager-de-ciscoOmisión de autenticación en Catalyst SD-WAN Manager de Cisco

Cisco ha publicado una vulnerabilidad de severidad crítica que, en caso de ser explotada, podría permitir a un atacante remoto no autenticado eludir la autenticación y acceder a la API de Cisco Catalyst SD-WAN Manager con privilegios de administrador. Cisco ha confirmado la explotación activa de CVE-2026-76504.

Official advisory ↗

CERT-FR · French · CERTFR-2026-AVI-1246Vulnérabilité dans Cisco Catalyst SD-WAN

Une vulnérabilité a été découverte dans Cisco Catalyst SD-WAN. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité. Cisco indique que la vulnérabilité CVE-2026-76504 est activement exploitée.

Official advisory ↗

NBSZ-NKI · Hungarian · cve-2026-76504CVE-2026-76504

A termék nem kezeli megfelelően azokat az eseteket, amikor a bevitt adat egészét vagy egy részét URL kódolással látták el.

Official advisory ↗

CSIRT Italia · Italian · cisco-rilevato-sfruttamento-in-rete-di-una-vulnerabilita-in-catalyst-sd-wan-managerCisco: rilevato sfruttamento in rete di una vulnerabilità in Catalyst SD-WAN Manager

La vulnerabilità identificata tramite la CVE-2026-76504, di tipo "Authentication Bypass", e con CVSS 3.1 pari a 9.8, interessa Cisco Catalyst SD-WAN Manager. Tale vulnerabilità è dovuta ad una gestione non adeguata della codifica URI nelle richieste HTTP, che consente di eludere una regola di autenticazione posta a protezione di uno specifico endpoint API. Un attaccante remoto non autenticato potrebbe sfruttare tale vulnerabilità mediante l'invio di richieste HTTP opportunamente predisposte, al fine di ottenere accesso alle API con privilegi amministrativi.

Official advisory ↗

JVN iPedia · Japanese · JVNDB-2026-036280シスコシステムズのCisco Catalyst SD-WAN ManagerにおけるURL エンコーディング（16進エンコーディング）の処理に関する脆弱性

Cisco Catalyst SD-WAN ManagerのAPIセッションベース認証管理における脆弱性により、認証されていないリモートの攻撃者が管理者ユーザーの権限で影響を受けるシステムへアクセスできる可能性があります。この脆弱性は、HTTPリクエスト内のURIエンコーディングの不適切な処理が原因であり、その結果、特定のAPIエンドポイントへのアクセスを制限する認証ルールを回避できます。攻撃者はこの脆弱性を悪用して、影響を受けるシステムのAPIに対して細工されたHTTPリクエストを送信する可能性があります。成功した攻撃により、認証を回避し、管理者ユーザーとしてAPIにアクセスできるようになります。

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-6977Cisco 제품 보안 업데이트 권고

Cisco Catalyst SD-WAN Manager에서 발생하는 Hex Encoding 취약점(CVE-2026-76504) [1][2]

Official advisory ↗

KISA KrCERT/CC · Korean · KNVD-6976美 CISA 발표 주요 Exploit 정보공유(Update. 2026-09-30)

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Official advisory ↗

NCSC-NL · Dutch · NCSC-2026-0395Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager

A vulnerability in Cisco Catalyst SD-WAN Manager's API session authentication allows unauthenticated remote attackers to bypass authentication via improper URI encoding, potentially granting admin-level access.

Official advisory ↗

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Fix availability varies by product
Affected: CSAFPID-271450
17.2.6
18.3.1.1
18.4.0.1
19.2.0
17.2.7
17.2.8
17.2.9
17.2.10
18.3.3.1
18.3.3
18.3.4
18.3.5
18.3.7
18.3.8
18.4.3
18.4.302
18.4.303
17.2.4
17.2.5
19.2.097
19.2.099
18.4.4
18.4.5
19.2.1
19.2.2
19.2.3
20.1.1.1
20.1.12
20.1.1
and 371 more
Fixed: No fixed version is explicitly recorded in the structured CVE data.
Action: Use the product-specific evidence above. Patch only products with a verified fixed release, and keep every affected or under-investigation state without a matching fix in the remediation queue.
Workaround: A mitigation or workaround reference is available from the source linked below; validate it against the affected product and version.

Evidence and provenance

Published 30 Sept 2026 · Last source change 2 Oct 2026, 23:23 UTC · CWE-177 · Improper Handling of URL Encoding (Hex Encoding)

CVE recordCVE.org · 5.2

CVSS sourceCNA

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-10-01

European sourceENISA EUVD · EUVD-2026-89950

Product sourceVendor CSAF · Cisco PSIRT

Remediation sourceVendor CSAF · Cisco PSIRT

CWE sourceCNA

NVD statusNVD enriched

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗

2 Oct 2026, 23:23 UTC
Vendor guidanceAuthoritative vendor guidance changed: added mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU; removed patch: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU.
Before
patch: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU · remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU
After
mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU · remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU
psirt@cisco.com ↗
2 Oct 2026, 23:23 UTC
Affected versionsThe structured affected or fixed version information changed.
Before
Cisco Catalyst SD-WAN Manager: 18.3.6, 18.3.7, 18.3.8, 17.2.10, 18.3.6.1, 18.2.0, 18.4.3, 18.4.1, 17.2.8, 18.3.3.1, 18.4.0, 18.3.1, 17.2.6, 17.2.9, 18.3.4, 17.2.5, 18.3.1.1, 18.3.5, 18.4.0.1, 18.3.3, 17.2.7, 17.2.4, 18.3.0 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
After
Cisco Catalyst SD-WAN Manager: 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.1.1.1, 20.1.1, 19.3.0, 19.2.2, 19.2.099, 18.3.6, 18.3.7, 19.2.0, 18.3.8, 19.0.0, 19.1.0, 18.4.302, 18.4.303, 19.2.097, 19.2.098, 17.2.10, 18.3.6.1, 19.0.1a, 18.2.0, 18.4.3, 18.4.1, 17.2.8, 18.3.3.1, 18.4.0, 18.3.1, 17.2.6, 17.2.9, 18.3.4, 17.2.5, 18.3.1.1, 18.3.5, 18.4.0.1, 18.3.3, 17.2.7, 17.2.4, 18.3.0, 19.2.3, 18.4.501_ES, 20.3.1, 20.1.2, 19.2.929, 19.2.31, 20.3.2, 19.2.32, 20.3.2_925, 20.3.2.1, 20.3.2.1_927, 18.4.6, 20.1.2_937, 20.4.1, 20.3.2_928, 20.3.2_929, 20.4.1.0.1, 20.3.2.1_930, 19.2.4, 20.5.0.1.1, 20.4.1.1, 20.3.3, 19.2.4.0.1, 20.3.2_937, 20.3.3.1, 20.5.1, 20.1.3, 20.3.3.0.4, 20.3.3.1.2, 20.3.3.1.1, 20.4.1.2, 20.3.3.0.2, 20.4.1.1.5, 20.4.1.0.01, 20.4.1.0.02, 20.3.3.1.7, 20.3.3.1.5, 20.5.1.0.1, 20.3.3.1.10, 20.3.3.0.8, 20.4.2, 20.4.2.0.1, 20.3.4, 20.3.3.0.14, 19.2.4.0.8, 19.2.4.0.9, 20.3.4.0.1, 20.3.2.0.5, 20.6.1, 20.5.1.0.2, 20.3.3.0.17, 20.6.1.1, 20.6.0.18.3, 20.3.2.0.6, 20.6.0.18.4, 20.4.2.0.2, 20.3.3.0.16, 20.3.4.0.5, 20.6.1.0.1, 20.3.4.0.6, 20.6.2, 20.7.1EFT2, 20.3.4.0.9, 20.3.4.0.11, 20.4.2.0.4, 20.3.3.0.18, 20.7.1, 20.6.2.1, 20.3.4.1, 20.5.1.1, 20.4.2.1, 20.4.2.1.1, 20.3.4.1.1, 20.3.813, 20.3.4.0.19, 20.4.2.2.1, 20.5.1.2, 20.3.4.2, 20.3.814, 20.4.2.2, 20.6.2.2, 20.3.4.2.1, 20.7.1.1, 20.3.4.1.2, 20.6.2.2.2, 20.3.4.0.20, 20.6.2.2.3, 20.4.2.2.2, 20.3.5, 20.6.2.0.4, 20.4.2.2.3, 20.3.4.0.24, 20.6.2.2.7, 20.6.3, 20.3.4.2.2, 20.4.2.2.4, 20.7.1.0.2, 20.8.1, 20.3.5.0.8, 20.3.5.0.9, 20.4.2.2.8, 20.3.5.0.7, 20.6.3.0.7, 20.6.3.0.5, 20.6.3.0.10, 20.6.3.0.2, 20.7.2, 20.9.1EFT2, 20.6.3.0.11, 20.6.3.1, 20.6.3.0.14, 20.6.4, 20.9.1, 20.6.3.0.19, 20.6.3.0.18, 20.3.6, 20.9.1.1, 20.6.3.0.23, 20.6.4.0.4, 20.6.3.0.25, 20.6.5, 20.6.3.0.27, 20.9.2, 20.9.2.1, 20.6.3.0.29, 20.6.3.0.31, 20.6.3.0.32, 20.10.1, 20.6.3.0.33, 20.9.2.0.01, 20.9.1_LI_Images, 20.10.1_LI_Images, 20.9.2_LI_Images, 20.3.7, 20.9.3, 20.6.5.1, 20.11.1, 20.11.1_LI_Images, 20.9.3_LI_ Images, 20.6.3.1.1, 20.9.3.0.2, 20.6.5.1.2, 20.9.3.0.3, 20.4.2.3, 20.6.3.2, 20.6.4.1, 20.6.3.0.38, 20.6.3.0.39, 20.3.5.1, 20.3.4.3, 20.9.3.1, 20.3.3.2, 20.6.5.2, 20.3.7.1, 20.10.1.1, 20.6.5.2.1, 20.3.4.0.25, 20.6.2.2.4, 20.6.1.2, 20.11.1.1, 20.9.3.0.5, 20.3.4.0.26, 20.6.5.1.3, 20.6.3.0.40, 20.1.3.1, 20.9.2.2, 20.6.5.2.3, 20.6.5.1.4, 20.6.5.3, 20.6.3.0.41, 20.9.3.0.7, 20.6.5.1.5, 20.9.3.0.4, 20.6.4.0.19, 20.6.5.1.6, 20.9.3.0.8, 20.6.3.3, 20.3.7.2, 20.6.5.4, 20.6.5.1.7, 20.9.3.0.12, 20.6.4.2, 20.6.5.5, 20.9.3.2, 20.11.1.2, 20.6.3.4, 20.10.1.2, 20.6.5.1.9, 20.9.3.0.16, 20.6.3.0.45, 20.6.5.1.10, 20.9.3.0.17, 20.6.5.2.4, 20.6.4.0.21, 20.9.3.0.18, 20.6.3.0.46, 20.6.3.0.47, 20.9.2.3, 20.9.3.2_LI_Images, 20.9.3.0.21, 20.9.3.0.20, 20.9.4_LI_Images, 20.9.4, 20.6.5.1.11, 20.12.1, 20.12.1_LI_Images, 20.6.5.1.13, 20.9.3.0.23, 20.6.5.2.8, 20.9.4.1, 20.9.4.1_LI_Images, 20.9.3.0.25, 20.9.3.0.24, 20.6.5.1.14, 20.3.8, 20.6.6, 20.9.3.0.26, 20.6.3.0.51, 20.9.3.0.29, 20.12.2, 20.12.2_LI_Images, 20.6.6.0.1, 20.13.1_LI_Images, 20.9.4.0.4, 20.13.1, 20.9.4.1.1, 20.9.5, 20.9.5_LI_Images, 20.12.3_LI_Images, 20.12.3, 20.9.4.1.3, 20.6.7, 20.9.5.1, 20.9.5.1_LI_Images, 20.9.4.1.6, 20.14.1, 20.14.1_LI_Images, 20.9.5.2, 20.9.5.2.1, 20.9.5.2_LI_Images, 20.12.3.1, 20.12.4, 20.15.1_LI_Images, 20.15.1, 20.9.5.1.4, 20.9.5.2.7, 20.9.5.2.13, 20.9.6, 20.9.6_LI_Images, 20.9.5.2.14, 20.6.8, 20.12.4.0.03, 20.16.1, 20.16.1_LI_Images, 20.12.4_LI_Images, 20.9.5.2.16, 20.12.4.0.4, 20.12.401, 20.9.5.3, 20.9.5.3_LI_Images, 20.12.4.1_LI_Images, 20.12.4.1, 20.9.5.2.21, 20.9.6.0.3, 20.12.4.0.6, 20.15.2_LI_Images, 20.15.2, 20.12.4_Monthly_ES5, 20.12.5, 20.12.5_LI_Images, 20.9.7_LI _Images, 20.9.7, 20.15.3, 20.15.3_ LI _Images, 20.12.501, 20.12.5.1_LI_Images, 20.12.5.1, 20.12.5.2_LI_Images, 20.12.5.2, 20.15.3.1, 20.15.4_LI_Images, 20.15.4, 20.9.7.1_LI _Images, 20.9.7.1, 20.18.1, 20.18.1_LI_Images, 20.12.6_LI_Images, 20.12.6, 20.12.5.1.01, 26.0.1, 20.9.8, 20.9.8_LI_Images, 20.18.2,… · Fixed: No fixed version is explicitly recorded in the structured CVE data.
CISA KEV ↗
2 Oct 2026, 23:18 UTC
Affected versionsThe structured affected or fixed version information changed.
Before
CSAFPID-271450; 17.2.6; 18.3.1.1; 18.4.0.1; 19.2.0; 17.2.7; 17.2.8; 17.2.9; 17.2.10; 18.3.3.1; 18.3.3; 18.3.4; 18.3.5; 18.3.7; 18.3.8; 18.4.3; 18.4.302; 18.4.303; 17.2.4; 17.2.5; 19.2.097; 19.2.099; 18.4.4; 18.4.5; 19.2.1; 19.2.2; 19.2.3; 20.1.1.1; 20.1.12; 20.1.1; and 378 more
After
CSAFPID-271450; 17.2.6; 18.3.1.1; 18.4.0.1; 19.2.0; 17.2.7; 17.2.8; 17.2.9; 17.2.10; 18.3.3.1; 18.3.3; 18.3.4; 18.3.5; 18.3.7; 18.3.8; 18.4.3; 18.4.302; 18.4.303; 17.2.4; 17.2.5; 19.2.097; 19.2.099; 18.4.4; 18.4.5; 19.2.1; 19.2.2; 19.2.3; 20.1.1.1; 20.1.12; 20.1.1; and 371 more
Cisco PSIRT ↗
1 Oct 2026, 03:55 UTC
Vendor guidanceAuthoritative vendor guidance changed: added mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU; removed patch: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU.
Before
patch: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU · remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU
After
mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU · remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU
psirt@cisco.com ↗
1 Oct 2026, 03:15 UTC
ENISA known-exploited stateENISA EUVD now records this CVE in its known-exploited dataset.
Before
not listed in ENISA EUVD known-exploited dataset
After
listed in ENISA EUVD known-exploited dataset (EUVD-2026-89950)
ENISA EUVD ↗
1 Oct 2026, 03:14 UTC
ENISA EUVD mappingEUVD-2026-89950 was added to the official ENISA EUVD mapping for this CVE.
Before
not recorded
After
{"euvdId":"EUVD-2026-89950"}
ENISA EUVD ↗
30 Sep 2026, 19:58 UTC
Vendor guidanceAuthoritative vendor guidance changed: added mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU; added remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU.
Before
no authoritative guidance recorded
After
mitigation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU · remediation: sec.cloudapps.cisco.com/cisco-sa-sdwan-webauth-xr8beuuU
psirt@cisco.com ↗
30 Sep 2026, 19:58 UTC
Remediation statusRemediation status changed from Awaiting fix to Mitigation available.
Before
Awaiting fix
After
Mitigation available
psirt@cisco.com ↗
30 Sep 2026, 19:14 UTC
BlackTree coverageBlackTree article coverage changed from no BlackTree article to 1 BlackTree article.
Before
no BlackTree article
After
1 BlackTree article
BlackTree editorial ↗
30 Sep 2026, 13:04 UTC
CISA KEV stateCISA KEV now confirms exploitation in the wild.
Before
not listed in CISA KEV
After
listed in CISA KEV since 2026-09-30
CISA KEV ↗
30 Sep 2026, 13:04 UTC
Catalogue recordCVE added to the BlackTree catalogue.
CNA ↗
30 Sep 2026, 13:00 UTC
Affected versionsThe structured affected or fixed version information changed.
Before
CSAFPID-271450; 17.2.6; 18.3.1.1; 18.4.0.1; 19.2.0; 17.2.7; 17.2.8; 17.2.9; 17.2.10; 18.3.3.1; 18.3.3; 18.3.4; 18.3.5; 18.3.7; 18.3.8; 18.4.3; 18.4.302; 18.4.303; 17.2.4; 17.2.5; 19.2.097; 19.2.099; 18.4.4; 18.4.5; 19.2.1; 19.2.2; 19.2.3; 20.1.1.1; 20.1.12; 20.1.1; and 339 more
After
CSAFPID-271450; 17.2.6; 18.3.1.1; 18.4.0.1; 19.2.0; 17.2.7; 17.2.8; 17.2.9; 17.2.10; 18.3.3.1; 18.3.3; 18.3.4; 18.3.5; 18.3.7; 18.3.8; 18.4.3; 18.4.302; 18.4.303; 17.2.4; 17.2.5; 19.2.097; 19.2.099; 18.4.4; 18.4.5; 19.2.1; 19.2.2; 19.2.3; 20.1.1.1; 20.1.12; 20.1.1; and 378 more
Cisco PSIRT ↗

2026-09-30CVE published

2026-09-30Added to CISA KEV

2026-10-02Mitigation reference recorded

ENISA EUVD · EUVD-2026-89950↗CVE authority or vendor reference · Cisco CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU↗CISA KEV record↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Published severity in operational context

Evidence used

Compensating controls

Verification

Remediation availability differs by product scope

Authoritative vendor CSAF and VEX advisories

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

ENISA European Vulnerability Database

EUVD-2026-89950

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

What changed after publication