Cisco Catalyst SD-WAN Manager Authentication Bypass via Hex Encoding (CVE-2026-76504)

let authBypassPaths = dynamic(["/dataservice", "/clusterManagement", "/j_security_check", "/admin", "/apidocs"]);
let encodedMarkers = dynamic(["%2e", "%2f", "%5c", "%25", "%2E", "%2F", "%5C"]);
W3CIISLog
| where csUriStem has_any (encodedMarkers) or csUriQuery has_any (encodedMarkers)
| where csUriStem has_any (authBypassPaths) or csUriStem has "dataservice"
| where scStatus in (200, 302, 401)
| extend DecodedPath = url_decode(csUriStem)
| where DecodedPath has_any (authBypassPaths)
| summarize RequestCount = count(), StatusCodes = make_set(scStatus), SamplePaths = make_set(csUriStem, 10) by cIP, csHost, bin(TimeGenerated, 10m)
| where RequestCount >= 1
| order by TimeGenerated desc

index=web (sourcetype="iis" OR sourcetype="cisco:sdwan:vmanage" OR sourcetype="ms:iis:auto")
| eval raw_uri=coalesce(cs_uri_stem,uri_path,uri)
| where match(raw_uri, "(?i)%2e|%2f|%5c|%25")
| eval decoded=urldecode(raw_uri)
| where match(decoded, "(?i)/(dataservice|clusterManagement|j_security_check|admin|apidocs)")
| stats count AS request_count values(raw_uri) AS encoded_paths values(sc_status) AS status_codes by c_ip, cs_host, _time
| where request_count >= 1
| sort - _time

any where event.category == "web" and
  (url.path : "*%2e*" or url.path : "*%2f*" or url.path : "*%5c*" or url.path : "*%25*" or url.original : "*%2e*" or url.original : "*%2f*") and
  (url.path : "*dataservice*" or url.path : "*clusterManagement*" or url.path : "*j_security_check*" or url.path : "*/admin*" or url.path : "*apidocs*") and
  http.response.status_code in (200, 302, 401)

SELECT sourceip, destinationip, "URL", "httpResponseCode", COUNT(*) AS request_count FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%' AND ("URL" IMATCHES '.*(%2e|%2f|%5c|%25).*') AND ("URL" IMATCHES '.*(dataservice|clusterManagement|j_security_check|/admin|apidocs).*') AND "httpResponseCode" IN ('200','302','401') GROUP BY sourceip, destinationip, "URL", "httpResponseCode" LAST 24 HOURS

_sourceCategory=*iis* OR _sourceCategory=*sdwan*
| parse regex "(?<method>\S+)\s+(?<uri>\S+)\s+HTTP" nodrop
| where uri matches /(?i).*(%2e|%2f|%5c|%25).*/
| where uri matches /(?i).*(dataservice|clusterManagement|j_security_check|\/admin|apidocs).*/
| count by src_ip, uri, status_code
| where _count >= 1

rule cisco_sdwan_cve_2026_76504_auth_bypass {
  meta:
    author = "Argus Detection Platform"
    description = "Detects CVE-2026-76504 hex-encoding auth bypass against Cisco Catalyst SD-WAN Manager"
    severity = "CRITICAL"
    cve = "CVE-2026-76504"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.referral_url, `(?i)(%2e|%2f|%5c|%25)`) or re.regex($e.target.url, `(?i)(%2e|%2f|%5c|%25)`)
    re.regex($e.target.url, `(?i)(dataservice|clusterManagement|j_security_check|/admin|apidocs)`)
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/Http|WebRequest/ 
| url := coalesce([UrlPath, HttpPath, Url])
| regex("(?i)(%2e|%2f|%5c|%25)", field=url)
| regex("(?i)(dataservice|clusterManagement|j_security_check|/admin|apidocs)", field=url)
| in(field=ResponseStatus, values=["200","302","401"])
| groupBy([SourceIp, DestinationIp, url], function=count(as=request_count))
| request_count >= 1