Cisco has identified a critical authentication bypass vulnerability in the Cisco Catalyst SD-WAN Manager, which attackers are currently exploiting This article explores 6a_security_check http cisco. . The flaw, tracked as CVE-2026-76504, allows unauthenticated remote attackers to gain administrative access to vulnerable SD-WAN management systems.

The problem arises from improper handling of URI encoding in HTTP requests. An attacker can send a specially crafted request to an exposed API to bypass authentication and gain administrator-level access, potentially allowing them to control a high-value SD-WAN management platform. The company provided an example involving the encoded character %6a, which represents the letter “j”: POST /%6a_security_check HTTP/1.1 Cisco also mentioned that %6a is just one example of how attackers can exploit this vulnerability.

For on-premises deployments, Cisco advises restricting SD-WAN Manager access from the public internet, allowing access only from known and trusted hosts, and placing SD-WAN control components behind filtering devices like firewalls. Customers who suspect a compromise should collect an admin-tech file using the request admin-tech command and open a Severity 3 TAC case referencing CVE-2026-76504. This upgrade will cut every SOC alert investigation by 21 minutes, enhancing your SOC's response capabilities with instant IOC context integration: Integrate TI Lookup into your SOC.