What is the CVSS score of CVE-2026-20191?

CVE-2026-20191 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of Cisco Catalyst Center are affected by CVE-2026-20191?

Cisco Catalyst Center is vulnerable to remote unauthenticated file access, allowing attackers to read sensitive data, configurations, and credentials without any login requirements.

How to fix or mitigate CVE-2026-20191?

24 HOURS: Identify and document all Cisco Catalyst Center deployments in your environment; enable detailed HTTP request logging; establish baseline of normal access patterns. 7 DAYS: Restrict network access to Catalyst Center to authorized administrative networks only; deploy Web Application Firewall or network rules to block path traversal attempts (including ../ and URL-encoded variants); audit recent access logs for signs of exploitation. 30 DAYS: Monitor Cisco security advisories for patch availability and affected version details; develop and test upgrade plan; rotate any credentials that may have been exposed during assessment period.

Cisco Catalyst Center CVE-2026-20191

EUVD-2026-41078 HIGH

Path Traversal (CWE-22)

2026-07-01 psirt@cisco.com

GHSA-46p9-p299-pr9p

Path Traversal Cisco

7.5

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated crafted HTTP request (AV:N/AC:L/PR:N/UI:N) yields read-only file disclosure within one container, so C:H with I:N/A:N and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:37 vuln.today

CVE Published

Jul 01, 2026 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container. 

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read arbitrary files from a restricted container of the affected device.

AnalysisAI

Arbitrary file read in Cisco Catalyst Center lets an unauthenticated, remote attacker retrieve files from a restricted container by sending a crafted HTTP request that abuses insufficient input validation (path traversal, CWE-22). Rated CVSS 7.5 (confidentiality-only impact), it exposes sensitive container-side data without any credentials or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Cisco Catalyst Center (formerly DNA Center) is Cisco's centralized network management and automation appliance for Catalyst campus and enterprise fabric environments, exposing web/HTTP management services that are internally decomposed into containerized microservices. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the application fails to sufficiently validate user-supplied input used to resolve a file path, so traversal sequences let a request escape the intended directory and read files elsewhere within a restricted container. Because the impact is scoped to a single container (Scope:Unchanged in the CVSS vector), disclosure is bounded to that container's filesystem rather than the full host.

RemediationAI

Consult the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X) and upgrade to the fixed Catalyst Center release Cisco specifies; no exact fixed version was included in the provided data, so pull the precise build directly from that advisory - Patch available per vendor advisory. As compensating controls until patched, restrict network reachability of the Catalyst Center management/HTTP interfaces to a dedicated management VLAN or jump-host subnet and block untrusted access to the web service (the vulnerability is AV:N/PR:N, so limiting who can send HTTP requests directly reduces exposure), and place the appliance behind a WAF or reverse proxy configured to reject path-traversal sequences (dot-dot-slash and encoded variants) in request paths - with the trade-off that WAF filtering is a partial, bypassable control and does not replace the vendor fix. Because impact is read-only within a restricted container, also rotate any secrets or credentials that may have been stored in reachable container files if compromise is suspected.