EUVD-2026-53469
GHSA-px9f-qgqp-xvc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Manager/Controller account
-
DeliveryReach management API over network
-
ExploitSend crafted input evading validation
-
ExecutionCross authorization scope boundary
-
PersistRead/alter cross-tenant policy and config
-
ImpactCompromise SD-WAN control plane
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network reachability to a Cisco Catalyst SD-WAN Manager or SD-WAN Controller management interface and a valid low-privileged authenticated account on that component (CVSS PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the authentication requirement: an attacker must first possess or obtain valid Manager/Controller credentials, which for most deployments means either an insider/low-tier operator, a stolen credential, or a chained prior compromise. A second practical limit is exposure: risk is materially higher where the management plane is reachable from broad internal networks or the internet rather than a segmented out-of-band admin network. The exact vulnerable feature or endpoint is not named in the vendor description (a generic internal-hardening summary covering multiple CWE-20 issues), so the specific triggering configuration is not confirmed from available data. |
| Impact | The signals are mostly aligned toward high priority but incomplete. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): remote, low complexity, only low privileges required, no user interaction, scope change, and full CIA impact - a textbook near-critical management-plane flaw. Mitigating the raw score somewhat: PR:L means the attacker must already hold a valid, if low-privileged, account on the Manager/Controller, so this is not an unauthenticated internet drive-by. Countervailing: management interfaces are frequently exposed to trusted admin networks where many operators hold low-tier accounts, so the PR:L bar is realistic in practice. No EPSS score was provided, so exploitation probability cannot be quantified. There is no KEV listing and no POC referenced, so this is not confirmed to be under active exploitation - treat it as a patch-soon issue rather than an emergency-tonight issue, but do not deprioritize given the CVSS and the blast radius of a compromised SD-WAN control plane. Note the description is a generic 'internal hardening' summary and does not name the exact endpoint or feature, so the precise attack surface is not confirmed from vendor text. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privileged Cisco Catalyst SD-WAN Manager account (for example, a limited operator or a compromised read-scoped credential) sends a crafted request to a Manager/Controller endpoint that fails to properly validate the input. The malformed input crosses the intended authorization boundary (scope change), letting the attacker read or alter policy, configuration, or data belonging to other devices/tenants and ultimately gain control of the SD-WAN management plane. No public proof-of-concept is known, but the low attack complexity and network vector make development straightforward for an attacker with valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the near-maximal CVSS and the centrality of the affected controllers make this a high-priority patch.
RemediationAI
Upgrade to a fixed Cisco Catalyst SD-WAN Manager and Controller release as specified in the Cisco advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); this is a Cisco hardening-release bundle, so consult its Fixed Software table to map your current train (17.2.x/18.x/19.x/20.x/26.x) to the corresponding patched build rather than assuming a single version. No exact universal fix version is stated in the provided data, so cite the advisory's per-branch fixed releases and do not deploy a version number not listed there. Because exploitation requires an authenticated low-privileged account, effective compensating controls until patching are: restrict management-plane reachability so SD-WAN Manager/Controller GUI and API are accessible only from a dedicated out-of-band admin network or via jump host (trade-off: may disrupt automation/CI integrations that call the API directly); tighten and audit local and RBAC accounts to eliminate unneeded low-privilege logins and enforce strong authentication/MFA on the Manager (trade-off: administrative overhead); and monitor Manager/Controller logs for anomalous API calls or cross-scope access attempts. These reduce, but do not eliminate, exposure, since any retained low-privileged user remains a potential vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN (formerly Viptela) is Cisco's enterprise software-defined WAN fabric; the two affected components per CPE - cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller - are the management and control planes. SD-WAN Manager (formerly vManage) is the centralized GUI/API orchestration and policy server, while the SD-WAN Controller (formerly vSmart) distributes routing and policy (via OMP) to WAN edge routers. The root cause is CWE-20 (Improper Input Validation): the software accepts attacker-supplied data without adequately constraining its type, length, format, or semantic bounds before acting on it. Because these components govern an entire WAN's routing and segmentation policy, a validation failure here that changes scope (S:C) can let an authenticated session influence resources it should never reach, including other tenants, devices, or subsystems managed by the same controller.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable management plane with only a low-privileged account (PR:L), low complexity, and a scope change (S:C) that exposes the broader control fabric to full confidentiality, integrity, and availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
Executive ViewAI
Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical privilege escalation vulnerability (CVSS 9.9) with no vendor patch available, allowing any authenticated low-privilege user to compromise network control and infrastructure configurations. No public exploit identified at time of analysis, but the absence of monitoring baselines makes compensating controls urgent. Organizations relying on these controllers for SD-WAN orchestration face immediate risk across their entire network fabric.
Restrict network access to SD-WAN controllers to authorized administrator networks using firewall rules and IP allowlists; disable all low-privilege user accounts not operationally required; enforce multi-factor authentication for all controller access; deploy real-time monitoring and alerting for suspicious authentication, privilege escalation attempts, and unauthorized configuration changes; consider implementing an additional authentication proxy or jump host for controller management access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB