What landed in CVE-land this week

Four entries hit CISA's Known Exploited Vulnerabilities catalog in the days leading up to 03 October 2026. The one that warrants top billing is CVE-2026-76504, an unauthenticated administrative access bug in Cisco Catalyst SD-WAN Manager. It is a textbook example of what happens when URI decoding occurs at two layers at different times; the fix takes hold only when you know exactly which API endpoint the attacker targets. This post covers the mechanism, how to assess whether an SD-WAN Manager you operate is exposed in the way the attack requires, and a note on CVE-2026-88771 and CVE-2026-88772, two Citrix NetScaler entries that landed in the same KEV window.

CVE-2026-76504: hex encoding bypasses an SD-WAN Manager auth rule

Cisco's advisory describes the flaw as a vulnerability in the API session-based authentication management of Catalyst SD-WAN Manager. The vendor's description is the clearest statement of mechanism available, and worth quoting directly: the flaw is "due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint." CISA's KEV entry echoes that framing, classifying it as a hex encoding vulnerability, confirming unauthenticated remote exploitation, and noting that a successful attacker gains admin-user privileges.

The anti-pattern is familiar to anyone who has debugged reverse proxies in front of application frameworks. An authentication gate is written as a path match against the raw request line: if the URI starts with /dataservice/admin the gate requires a session; otherwise it treats the request as a public endpoint. The application behind the gate canonicalises the path by percent-decoding it before dispatching to a handler. The attacker finds a byte sequence that fails the gate's string comparison but canonicalises to the protected path downstream. Percent-encoding one character of the sensitive prefix is the classical move, and it matches the shape Cisco's description points to.

Use the following curl requests in your own lab only; never run them against third-party assets you do not operate. The target is a placeholder:

# Legitimate protected path: fails at the auth gate as expected
curl -skI "https://sdwan.example.com/dataservice/admin/user"

# Hex-encoded first character: may bypass a naive prefix-match gate
# %2f = '/', %64 = 'd'. The server still routes to /dataservice/...
curl -skI "https://sdwan.example.com/%64ataservice/admin/user" \
  -H "Accept: application/json"

In your access logs, look for 2xx responses on requests whose raw path contains percent-encoded ASCII letters inside the /dataservice/ prefix, from IPs with no prior session establishment on the API. A Splunk-style query against your WAF or load balancer, pseudocoded:

index=sdwan_proxy sourcetype=http
| where match(uri_raw, "(?i)%(?:2[fF]|[2-7][0-9a-fA-F])")
    AND match(uri_raw, "(?i)dataservice")
    AND status>=200 AND status<300
| stats count by src_ip, uri_raw, user_agent

The query is intentionally noisy. Legitimate clients rarely percent-encode letters in a path. Flag any volume of these from a small set of source IPs as suspect until you can match each against a known-good automation user.

The attack prerequisites are minimal: network reach to the SD-WAN Manager's HTTPS listener, no credential, and the ability to craft the HTTP request by hand. The blast radius is admin-level: on SD-WAN Manager, that means the control plane for every edge device it manages. Start with exposure review.

Three questions, in order:

  1. Is the SD-WAN Manager web UI, or any /dataservice/ path, reachable from anything other than your management network? If the answer is "the public internet" or "the corporate user LAN," close that first.
  2. Has your organisation applied the fixed release Cisco shipped for the affected trains? Treat anything prior to the vendor's patched version as vulnerable.
  3. Do your WAF rules match on the decoded path or on the raw request line? Rules that match the raw line are exactly what this flaw defeats. Switch to a decoded-path match, or layer a second rule that rejects any percent-encoded alpha character in the prefix of a known-sensitive route.

CISA's current KEV remediation directive, BOD 26-04 (Prioritizing Security Updates Based on Risk), took effect 10 June 2026. It carried the KEV criteria forward from BOD 22-01, which it supersedes. Federal civilian agencies carry a binding obligation to remediate KEV entries under that directive. Private operators should treat KEV listing as the signal: CISA applies the "actively exploited" designation only when real intrusions have been documented.

Citrix NetScaler: two entries, one urgent pattern

The 27 September 2026 KEV update added two Citrix NetScaler ADC and NetScaler Gateway entries; both target the same appliance class on the same perimeter. CISA describes CVE-2026-88771 as improper input validation allowing an unauthenticated attacker to execute arbitrary commands. CISA describes CVE-2026-88772 as improper restriction of operations within the bounds of a memory buffer, with remote code execution or denial of service as outcomes. Both are confirmed in-the-wild exploited; neither requires an authenticated session; both land on an appliance that typically sits at the internet edge terminating VPN or published-app traffic.

If you operate NetScaler ADC or Gateway, apply the standard defensive sequence for an edge appliance under active abuse: install the fixed firmware, rotate all administrative credentials, invalidate existing user sessions, and inspect for post-exploitation artefacts (web shell drops in NetScaler's filesystem, unexpected outbound connections from the appliance, and configuration changes not made through your own change pipeline). For an appliance carrying an in-the-wild unauthenticated RCE, assume compromise is already in flight: investigate first, then confirm patch state.

Lower-tier reads worth your attention

Cisco's 03 October 2026 advisory tranche is heavy on critical-rated items not yet in KEV: CVE-2026-20079 and CVE-2026-20242 against Secure Firewall Management Center; CVE-2026-20176, CVE-2026-20282, and CVE-2026-76423 against Identity Services Engine; and CVE-2026-76461 against Secure Email Gateway. None have been reported as exploited. All sit on infrastructure that will eventually attract exploit development: management planes and perimeter mail. Patch windows for these should not slip into "whenever we next touch the box."

The pattern across the week is unglamorous but consistent. Edge and management appliances face the most pressure because they fail open to the whole internet by default, and the vulnerabilities weaponised fastest are those a competent attacker can reach without a credential or a prior foothold. Decode-aware WAF rules, aggressive management-plane segmentation, and a patch cadence that treats KEV additions as the forcing function will carry most of the defensive weight.

Verifiable security.