cve-2026-76504-nuclei

Affected Versions (from public reporting)

• Earlier than 20.9 — all releases
• 20.9 — prior to 20.9.10.1
• 20.12 — prior to 20.12.8.2
• 20.15 — prior to 20.15.6.1
• 20.18 — prior to 20.18.4.1
• 26.1 — prior to 26.1.2.1
• 26.2 — prior to 26.2.1

Indicators of Compromise (host-side)

Log file	What to look for
/var/log/nms/containers/service_proxy/serviceproxy-access.log	Requests to /%6a_security_check from unknown IPs
/var/log/nms/vmanage-server.log	j_security_check requests referencing viptela-reserved-* users

Additional red flags:

• 200 responses with an empty body on a login endpoint
• /dataservice/client/token calls from sessions younger than ~1 second
• tenantbackup/export jobs initiated by unusual accounts

WAF rule

(?i)/(%[0-9a-f]{2})*j(_|%5f)security(_|%5f)check