What is the CVSS score of EUVD-2026-53460?

EUVD-2026-53460 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco Catalyst SD-WAN are affected by EUVD-2026-53460?

Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical privilege escalation vulnerability (CVE-2026-20304, CVSS 9.9) that allows authenticated users to bypass access controls and…

How to fix or mitigate EUVD-2026-53460?

Within 24 hours, complete an inventory of all Cisco Catalyst SD-WAN Manager and SD-WAN Controller instances and restrict console access to essential personnel only, implementing strict role-based access controls to prevent low-privileged users from accessing sensitive management functions. Within 7 days, enable enhanced audit logging on all management plane access, establish continuous monitoring and 24/7 alerting for privilege escalation attempts and anomalous user behavior, and brief network operations and security teams on the vulnerability and interim protective measures. Within 30 days, establish a remediation timeline by monitoring Cisco security advisories for patch availability, prepare a phased deployment plan for patched versions once released, and consider deploying interim network-based protections such as IP address whitelisting or VPN-required access controls for SD-WAN management interfaces.

Cisco Catalyst SD-WAN EUVD-2026-53460

| CVE-2026-20304 CRITICAL

Improper Access Control (CWE-284)

2026-08-05 cisco

GHSA-pqwq-qr78-m9wc

Cisco Authentication Bypass Cisco Catalyst Sd Wan Controller Cisco Catalyst Sd Wan Manager

9.9

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable management plane exploitable by an existing low-privileged account (PR:L, AC:L); improper access control on the fabric orchestrator justifies scope change and full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:24 vuln.today

CVE Published

Aug 05, 2026 - 16:19 nvd

CRITICAL 9.9

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

AnalysisAI

Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a low-privileged, remote authenticated attacker to abuse improper access-control checks (CWE-284) to reach functionality or data intended for higher-privileged roles, with full confidentiality, integrity, and availability impact (CVSS 9.9, scope changed). The flaw was discovered internally by Cisco during a proactive hardening review and shipped as part of a consolidated software-hardening release; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SD-WAN Manager is the central orchestration plane for an entire SD-WAN fabric, successful abuse can cascade beyond the compromised component to the managed network.

Technical ContextAI

The affected systems are Cisco's Catalyst SD-WAN management plane: SD-WAN Manager (formerly vManage), the centralized web/API management and orchestration console, and SD-WAN Controller (formerly vSmart), which distributes control-plane policy across the fabric via OMP. The root cause class is CWE-284 (Improper Access Control), meaning the software fails to correctly enforce that a requesting identity is authorized for the requested operation or resource - this maps to the vendor/community tag of 'Authentication Bypass' and typically manifests as missing role/permission checks on API endpoints, functions, or objects. Per the CPE data the vulnerable products are cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager. Cisco bundled multiple internally discovered issues under this advisory, so CVE-2026-20304 represents a grouped set of access-control weaknesses rather than a single code path.

RemediationAI

Upgrade Cisco Catalyst SD-WAN Manager and SD-WAN Controller to the fixed builds published in Cisco's software-hardening advisory (Patch available per vendor advisory: cisco-sa-hardening-sdwan-faLcR3K at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); the exact patched version for your specific train is not enumerated in the available data, so map your running build against the advisory's fixed-release table before upgrading. Until you can patch, reduce exposure by restricting network reachability of the SD-WAN Manager/Controller management interfaces to a dedicated out-of-band management network or trusted jump hosts (control-plane isolation is standard Cisco SD-WAN guidance and has minimal side effects), enforcing least-privilege and auditing all low-privileged/local user accounts since PR:L means an existing low-priv account is the entry point (trade-off: administrative overhead reviewing role assignments), and enabling/monitoring RBAC and API access logging to detect authorization anomalies. Because the fix is an access-control correction with no documented feature-level workaround, upgrading is the only true remediation; the compensating controls above only shrink the attackable population of authenticated users.