Improper URI encoding handling in Cisco Catalyst SD-WAN Manager API session auth lets an unauthenticated remote attacker access the API as the admin user. Improper handling of URI (hex) encoding in HTTP requests bypasses an authentication rule protecting a specific API endpoint .Actively exploited, the vulnerability affects versions include 17.2.4-17.2.10 and 18.2.0, 18.3.0-18.3.8 (incl. 18.3.3.1, 18.3.6.1), 18.4.0-18.4.3. Upgrade to Cisco fixed release per advisory.