OTPulse

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

Act NowCVSS 9.8cisco-sa-sdwan-webauth-xr8beuuUSep 30, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the API authentication of Cisco Catalyst SD-WAN Manager allows an unauthenticated remote attacker to bypass authentication and access the system as an admin user. The vulnerability exists in how the system handles URI encoding in HTTP requests, allowing an attacker to circumvent authentication rules protecting the API endpoint. An attacker could send a specially crafted HTTP request to exploit this vulnerability and gain admin-level API access. This vulnerability is actively being exploited in the wild.

What this means
What could happen
An attacker could bypass authentication and gain admin-level access to your SD-WAN Manager API without any credentials, allowing them to reconfigure your entire SD-WAN network, including branch routers and connectivity policies.
Who's at risk
SD-WAN administrators and network engineers who manage Cisco Catalyst SD-WAN deployments. This affects all branch sites and core network connections that are managed by the vulnerable SD-WAN Manager appliance.
How it could be exploited
An attacker sends a specially crafted HTTP request with URI encoding tricks to the SD-WAN Manager API endpoint. The malformed request bypasses the authentication check that normally restricts API access, and the attacker gains the same privileges as an admin user. From there, they can make any API call to modify SD-WAN configuration.
Prerequisites
  • Network access to the SD-WAN Manager API port (typically port 8443)
  • No credentials or authentication tokens required
remotely exploitableno authentication requiredlow complexityactively exploited (KEV)critical CVSS (9.8)affects network control and management systems
Exploitability
Actively exploited — confirmed by CISA KEV
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (1)
ProductAffected VersionsFix Status
Cisco Catalyst SD-WAN Manager API17.2.10 through 18.4.3Fix available
Remediation & Mitigation
0/3
Do now
0/2
HOTFIXUpdate Cisco Catalyst SD-WAN Manager to version 18.4.4 or later
WORKAROUNDRestrict network access to the SD-WAN Manager API port (port 8443) to only trusted administrative hosts and management subnets using firewall rules
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate SD-WAN Manager from untrusted networks
View full vendor advisory
API: /api/v1/advisories/85864d8e-f771-47e9-a89a-de8aeb60bc3e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.