EUVD-2026-89950
GHSA-xqjc-v467-8fvf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N) bypasses auth to gain admin API access, giving full confidentiality, integrity, and availability control of the controller (C/I/A:H, S:U).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the Cisco Catalyst SD-WAN Manager HTTP API; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the supplied data at time of analysis, so the immediate action is to consult Cisco's advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU) for the fixed software build and migrate to it as soon as Cisco publishes the release; until then treat the vulnerability as unpatched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco Catalyst SD-WAN Manager (vManage) instances and determine which management/API interfaces are reachable from untrusted networks, then immediately restrict access to trusted management networks via firewall rules, ACLs, or VPN and block public exposure of the vManage management/API interface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today