思科警告攻击者利用SD-WAN管理器中的关键身份验证绕过漏洞

攻击者正在利用思科Catalyst SD-WAN管理器中的一个新的关键零日漏洞，该系统是公司用于管理其思科SD-WAN网络的工具，思科在9月30日的公告中表示。

该漏洞，CVE-2026-76504，可能允许没有登录权限的远程攻击者以管理员用户的身份使用管理器的API。已发布修复版本，并且没有替代解决方案。它的CVSS评分为9.8（满分10分）。该漏洞位于管理器API处理登录会话的部分。

管理器在HTTP请求中错误处理URI编码。因此，经过精心构造的请求可以绕过旨在限制对单个API端点访问的身份验证规则。

攻击者无需凭据，只需能够向管理器的API发送该请求。思科表示，暴露于互联网的管理器面临被攻陷的风险。默认情况下，管理员用户拥有netadmin角色，可以在设备上执行所有操作。

思科表示，其产品安全事件响应团队“在2026年9月意识到该漏洞的主动利用”。该漏洞是在思科的技术支持中心（TAC）处理一个支持案例时发现的。

公告没有说明有多少客户受到攻击，攻击何时开始，攻击者是谁，或者攻击者利用访问权限做了什么。

谁需要升级

该漏洞影响SD-WAN管理器，无论系统如何配置。没有其他产品被列为受影响。以下是每个发布列车的首次修复版本：

发布列车

首次修复版本

早于20.9

迁移到修复版本

20.9

20.9.10.1

20.12

20.12.8.2

20.15

20.15.6.1

20.18

20.18.4.1

26.1

26.1.2.1

26.2

26.2.1

CVE-2026-76504与之前修复的三个思科SD-WAN漏洞是独立的：5月的CVE-2026-20182，以及6月的CVE-2026-20245和CVE-2026-20262。

对公告的比较显示，这些漏洞的修复版本都早于上表中的版本。因此，最后一次为5月或6月修复升级的管理器仍然需要此更新。

该表未列出20.10、20.11、20.13、20.14或20.16发布列车，而思科的5月公告中列出了这些。公告也没有提到思科SD-WAN Cloud-Pro或思科SD-WAN for Government（FedRAMP），这两种部署类型在5月和6月的公告中提到。

思科SD-WAN Cloud（思科托管）已经在20.15.605版本中修复，使用该版本的客户无需采取任何行动。在本地管理器升级之前，思科建议限制来自不安全网络（如互联网）的访问。在需要互联网访问的情况下，只应允许已知的、可信的主机进入，并且控制组件应位于防火墙后面。

思科Catalyst SD-WAN Cloud托管环境已经实施了此缓解措施。根据思科的说法，该缓解措施在测试环境中有效，思科建议客户在应用之前评估其对自己网络的影响。

思科的SD-WAN加固指南表示，管理接口（如端口443、22和830）不应直接暴露于互联网。对管理器的HTTPS访问应仅来自跳转主机或管理子网。

检查妥协迹象

思科描述的妥协迹象涉及j_security_check，这是管理器用于基于会话的登录的请求路径。在思科的示例中，该路径的一个字符被URI编码，变为/%6a_security_check，其中%6a代表字母j。

两个日志文件是查找来自未知或未经授权的IP地址的j_security_check条目的地方：

文件：/var/log/nms/containers/service-proxy/serviceproxy-access.log

文件：/var/log/nms/vmanage-server.log，特别是以viptela-reserved-开头的用户的条目。

以viptela-reserved-开头的名称属于保留的系统服务帐户。

请求中的任何一个字符都可以被编码，因此%6a只是一个示例。相同的条目也可能在正常操作期间出现，每个匹配项必须与正常活动进行检查，以避免误报。

为了帮助确定管理器是否被妥协，客户可以向思科TAC提交一个严重性3的案例，并在标题中包含CVE-2026-76504。思科要求他们首先在管理器上运行request admin-tech，以便可以审核输出文件。

公告中没有检测规则，也没有说明升级是否会移除已经获得访问权限的攻击者。思科针对5月漏洞和6月首个漏洞的公告表示，仅更新不会解决确认的妥协。他们告诉客户在升级之前收集admin-tech文件。

CVE-2026-76504跟随一系列被标记为在今年被利用的思科SD-WAN漏洞。截至9月30日，美国网络安全和基础设施安全局（CISA）的已知利用漏洞目录列出了2026年新增的八个思科SD-WAN漏洞。

觉得这篇文章有趣吗？请关注我们的Google新闻、Twitter和LinkedIn，阅读更多我们发布的独家内容。

相关漏洞

CVE-2026-76504 CVSS 9.8 CRITICAL Analyzed

CVE-2026-76504 - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability - [Actively Exploited]

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

CVE-2026-20262 CVSS 6.5 MEDIUM Analyzed

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability - [Actively Exploited]

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

CVE-2026-20245 CVSS 7.8 HIGH Analyzed

CVE-2026-20245 - Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability - [Actively Exploited]

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

CVE-2026-20182 CVSS 10 CRITICAL Analyzed

CVE-2026-20182 - Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability - [Actively Exploited]

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.  A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.

思科警告攻击者利用SD-WAN管理器中的关键身份验证绕过漏洞

相关漏洞

更多来自 The Hacker News