EUVD-2026-53471
GHSA-fhhx-46fx-737r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged SD-WAN Manager admin access
-
DeliveryPlant or reference crafted symbolic link
-
ExploitTrigger file operation that follows link (CWE-59)
-
ExecutionRedirect access to unintended host file
-
PersistRead/overwrite/destroy data across scope boundary
-
ImpactCompromise management plane integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires the attacker to already hold high (administrative) privileges on the Cisco Catalyst SD-WAN Manager or SD-WAN Controller management plane (CVSS PR:H), reachable over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The concrete prerequisite is the ability to influence a file operation that follows an attacker-controllable symbolic link (CWE-59) so it resolves to an unintended target; this is inherently gated by having authenticated privileged access to the appliance's management functions. Limiting factors that reduce realistic risk: the PR:H requirement excludes anonymous/unauthenticated attackers, so the threat is primarily a malicious or compromised administrator, and exposure is further constrained where the SD-WAN Manager/Controller management interface is confined to a protected out-of-band network rather than broadly reachable. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H yields 9.1 (Critical), but the individual metrics tell a more nuanced story: AV:N and AC:L lower the bar, while PR:H means the attacker must already hold high (administrative) privileges on the SD-WAN management plane, which is the dominant limiting factor. This is not an unauthenticated remote takeover; it is a privilege- and scope-escalation primitive available to an already-authenticated privileged user, which is why the vendor framed it as internal hardening rather than an emergency. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so exploitation-probability signals are absent - treat exploitation likelihood as low/unproven while impact is high. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vector (which implies write/destroy, not just read), so the tag likely understates impact - rely on the CVSS vector over the tag. Overall: real priority for internet- or management-network-exposed SD-WAN Manager instances, but the PR:H prerequisite substantially narrows the realistic threat to insiders or attackers who have already compromised admin credentials. |
| Exploit ScenarioDerived | An attacker who has obtained privileged administrator access to a Cisco Catalyst SD-WAN Manager appliance - for example via stolen or phished admin credentials - places or references a crafted symbolic link so that a normal management file operation follows the link to a sensitive host path. Because the software resolves the link before checking the target, the attacker reads, overwrites, or deletes files outside the intended scope, escalating their control over the management plane and potentially the fabric. No public exploit code is identified at time of analysis, and successful abuse depends on already holding the high privilege level required by the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to abuse improper symbolic-link resolution (CWE-59) to read, overwrite, or destroy files outside intended boundaries, with a scope-changing impact that reaches beyond the vulnerable process. The flaw was found during Cisco's internal SD-WAN security review and remediated in hardening releases; it carries a CVSS 9.1 rating driven by network reach, low complexity, and high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and management-plane exposure make it a meaningful patching priority.
RemediationAI
Upgrade to the fixed SD-WAN Manager and SD-WAN Controller releases identified in Cisco advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); patch available per vendor advisory, but no single exact fixed version string is included in the provided data, so consult the advisory's fixed-release table to map your current train (17.2.x/18.x/19.x/20.x/26.1.x) to its patched build. Because exploitation requires high privileges, the most effective compensating controls until you can patch are to tightly restrict and audit administrative access to SD-WAN Manager and Controller: limit management-plane reachability to a dedicated out-of-band management network or jump host (trade-off: may complicate remote administration), enforce strong role-based access control and MFA on all vManage/vSmart admin accounts to shrink the pool of principals who could reach PR:H (trade-off: operational overhead), and monitor for unexpected file or symlink activity and configuration changes on the appliances. Do not rely on network filtering alone as a substitute for the patch, since the flaw is exploitable by legitimate privileged users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Catalyst SD-WAN (formerly Viptela) is Cisco's software-defined WAN fabric; SD-WAN Manager (vManage) is the centralized management/orchestration controller and SD-WAN Controller (vSmart) distributes control-plane policy to edge routers. The CPE data confirms the two affected components are cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller. The root cause is CWE-59, improper link resolution before file access (a link-following / symlink flaw): the software follows a filesystem link without validating its target, so an operation intended for a controlled path can be redirected to an arbitrary file. On an appliance where the attacker already holds privileged access, this lets file operations escape their intended directory, and the CVSS scope change (S:C) indicates the impact crosses a security boundary of the underlying host or another component.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Reachable over the management network at low complexity but gated by administrative access (PR:H); symlink abuse crosses a host boundary (S:C) enabling file read, overwrite, and destruction (C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.
Executive ViewAI
Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical file-manipulation vulnerability (CVE-2026-20310, CVSS 9.1) that allows authenticated users to read, modify, or delete files outside application boundaries, directly threatening SD-WAN infrastructure integrity and availability. Organizations relying on Cisco SD-WAN for WAN connectivity face potential service disruption and data compromise; no vendor patch is currently available. Immediate inventory and compensating controls are required to reduce exposure until remediation is released.
No vendor-released patch identified at time of analysis. Interim controls: restrict SD-WAN management-plane network access to isolated administrative networks and trusted accounts; enable file-system audit logging and real-time monitoring for suspicious access or symbolic link operations; maintain current backups of critical SD-WAN configuration files for rapid recovery; enforce least-privilege process execution for SD-WAN management services; monitor Cisco security advisories for patch availability and test immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB