A crafted HTTP request can give attackers administrator-level API access to Cisco Catalyst SD-WAN Manager without a login. Cisco says the flaw is already being exploited. Cisco disclosed CVE-2026-76504 on 30 September and gave it a critical CVSS score of 9.8. The company says an unauthenticated remote attacker can abuse improper URI encoding to bypass an authentication rule and reach the Catalyst SD-WAN Manager API with the privileges of the admin user. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue only hours later. This is not a theoretical patch-cycle item. It is a management-plane exposure with confirmed exploitation and a three-day federal remediation window. One encoded character can defeat the authentication rule The vulnerable logic is meant to restrict access to a particular API endpoint. Cisco says encoding a character in the request URI can let a crafted request slip past that rule. Cisco's example uses %6a in place of the letter j in j_security_check, but that is only an illustration. The advisory warns that an attacker can encode any one character in the request to trigger the vulnerable behaviour. Detection that looks only for /%6a_security_check will therefore be too narrow. The vulnerability affects Cisco Catalyst SD-WAN Manager regardless of system configuration. Actual remote reachability still matters. Cisco specifically warns that systems with ports exposed to the internet are at risk, and recommends preventing access from unsecured networks. Administrator API access is not the same as root A successful attack provides administrator-level access to the SD-WAN Manager API.…