What is the CVSS score of CVE-2026-20303?

CVE-2026-20303 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco Catalyst SD-WAN are affected by CVE-2026-20303?

Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical privilege escalation vulnerability (CVSS 9.9) with no vendor patch available, allowing any authenticated low-privilege user to…

How to fix or mitigate CVE-2026-20303?

Within 24 hours: audit all active user accounts with access to SD-WAN controllers, immediately disable any unnecessary low-privilege accounts, and restrict network access to SD-WAN Manager and Controller management interfaces to trusted administrator networks only. Within 7 days: deploy enhanced logging and real-time monitoring on all SD-WAN controllers to detect suspicious authentication patterns, privilege escalation attempts, and unauthorized configuration changes; implement web application firewall rules to filter malformed input to controller APIs. Within 30 days: establish formal escalation with Cisco for vulnerability remediation timeline and interim patch guidance; document current SD-WAN topology and access patterns to support future segmentation decisions; and conduct a forensic audit of all controller logs to identify any unauthorized access attempts.

Cisco Catalyst SD-WAN CVE-2026-20303

EUVD-2026-53469 CRITICAL

Improper Input Validation (CWE-20)

2026-08-05 cisco

GHSA-px9f-qgqp-xvc4

Information Disclosure Cisco Cisco Catalyst Sd Wan Controller Cisco Catalyst Sd Wan Manager

9.9

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable management plane with only a low-privileged account (PR:L), low complexity, and a scope change (S:C) that exposes the broader control fabric to full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:24 vuln.today

CVE Published

Aug 05, 2026 - 16:29 nvd

CRITICAL 9.9

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.

AnalysisAI

Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to a Cisco Catalyst SD-WAN Manager or SD-WAN Controller management interface and a valid low-privileged authenticated account on that component (CVSS PR:L) - it is NOT unauthenticated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mostly aligned toward high priority but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to a fixed Cisco Catalyst SD-WAN Manager and Controller release as specified in the Cisco advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); this is a Cisco hardening-release bundle, so consult its Fixed Software table to map your current train (17.2.x/18.x/19.x/20.x/26.x) to the corresponding patched build rather than assuming a single version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: audit all active user accounts with access to SD-WAN controllers, immediately disable any unnecessary low-privilege accounts, and restrict network access to SD-WAN Manager and Controller management interfaces to trusted administrator networks only. …

Threat intelligence, references, and detailed analysis are available after sign-in.