EUVD-2026-53460
GHSA-pqwq-qr78-m9wc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged SD-WAN account
-
DeliveryReach Manager/Controller management API
-
ExploitSend request to under-protected endpoint
-
ExecutionBypass access-control check
-
PersistAccess or modify admin-level resources
-
ImpactAlter fabric control-plane policy
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker already possess valid low-privileged authenticated access (CVSS PR:L) to the Cisco Catalyst SD-WAN Manager or SD-WAN Controller management/API interface and network reachability to it (AV:N); no user interaction and no elevated privileges are needed (UI:N, AC:L). The specific weakness is improper access control (CWE-284) on management-plane functionality, so the concrete prerequisite is an authenticated session against the SD-WAN Manager/Controller - this is what LIMITS exploitation: an unauthenticated outsider with no account and no path to the management network cannot trigger it. Realistic risk is therefore driven by how many low-trust accounts exist and how exposed the management interface is; deployments that keep the SD-WAN control/management plane on an isolated network and tightly limit operator accounts materially raise the bar. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) signals a genuinely high-priority issue: network-reachable, low attack complexity, no user interaction, only low privileges required, and a scope change with total CIA impact - consistent with a management-plane device that governs the whole fabric. The single most important limiting factor is PR:L: the attacker must already hold some authenticated (low-privileged) foothold on SD-WAN Manager/Controller, so this is a privilege-escalation/lateral-authorization flaw rather than pre-auth RCE. No EPSS score was provided in the input, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; there is also no public POC identified, indicating exploitation risk is currently theoretical but high-value. Note a mild tension: the 'Authentication Bypass' tag could imply no auth, yet the authoritative CVSS PR:L indicates authentication IS required - per precision rules the CVSS metric governs, so treat this as authenticated. Because these were internally discovered by the vendor and fixed proactively, real-world exploitation likelihood is presently lower than the raw 9.9 suggests, but the score correctly reflects worst-case impact and patching should be prioritized for internet- or partner-reachable management planes. |
| Exploit ScenarioDerived | A user holding a low-privileged account on SD-WAN Manager (for example a read-only operator, tenant, or helpdesk role) sends crafted authenticated API or web requests to endpoints that fail to properly verify authorization, and thereby reads or modifies configuration, policy, or objects reserved for administrators. Because scope is changed and the Manager orchestrates the fabric, the attacker can pivot to alter control-plane policy affecting downstream edge routers. No public POC is identified at time of analysis, and the AC:L/UI:N metrics indicate that once authenticated, exploitation is straightforward and requires no victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network.
RemediationAI
Upgrade Cisco Catalyst SD-WAN Manager and SD-WAN Controller to the fixed builds published in Cisco's software-hardening advisory (Patch available per vendor advisory: cisco-sa-hardening-sdwan-faLcR3K at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); the exact patched version for your specific train is not enumerated in the available data, so map your running build against the advisory's fixed-release table before upgrading. Until you can patch, reduce exposure by restricting network reachability of the SD-WAN Manager/Controller management interfaces to a dedicated out-of-band management network or trusted jump hosts (control-plane isolation is standard Cisco SD-WAN guidance and has minimal side effects), enforcing least-privilege and auditing all low-privileged/local user accounts since PR:L means an existing low-priv account is the entry point (trade-off: administrative overhead reviewing role assignments), and enabling/monitoring RBAC and API access logging to detect authorization anomalies. Because the fix is an access-control correction with no documented feature-level workaround, upgrading is the only true remediation; the compensating controls above only shrink the attackable population of authenticated users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected systems are Cisco's Catalyst SD-WAN management plane: SD-WAN Manager (formerly vManage), the centralized web/API management and orchestration console, and SD-WAN Controller (formerly vSmart), which distributes control-plane policy across the fabric via OMP. The root cause class is CWE-284 (Improper Access Control), meaning the software fails to correctly enforce that a requesting identity is authorized for the requested operation or resource - this maps to the vendor/community tag of 'Authentication Bypass' and typically manifests as missing role/permission checks on API endpoints, functions, or objects. Per the CPE data the vulnerable products are cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager. Cisco bundled multiple internally discovered issues under this advisory, so CVE-2026-20304 represents a grouped set of access-control weaknesses rather than a single code path.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable management plane exploitable by an existing low-privileged account (PR:L, AC:L); improper access control on the fabric orchestrator justifies scope change and full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Executive ViewAI
Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical privilege escalation vulnerability (CVE-2026-20304, CVSS 9.9) that allows authenticated users to bypass access controls and assume unauthorized administrative privileges. No public exploit has been identified at time of analysis. Since SD-WAN Manager is the central orchestration plane for your entire SD-WAN fabric, successful exploitation could cascade to compromise network-wide connectivity, enable unauthorized data access, and disable critical security controls across all branch offices and remote sites.
No vendor-released patch identified at time of analysis. Interim compensating controls include: restricting SD-WAN Manager administrative console access to a whitelist of trusted source IP addresses, implementing and enforcing role-based access controls to prevent low-privileged authenticated users from accessing sensitive management functions, enabling comprehensive audit logging and real-time alerting for administrative actions and privilege escalation attempts, and deploying network-based intrusion detection signatures to identify exploitation patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB