What is the CVSS score of EUVD-2026-53469?

EUVD-2026-53469 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco Catalyst SD-WAN are affected by EUVD-2026-53469?

Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical privilege escalation vulnerability (CVSS 9.9) with no vendor patch available, allowing any authenticated low-privilege user to…

How to fix or mitigate EUVD-2026-53469?

Within 24 hours: audit all active user accounts with access to SD-WAN controllers, immediately disable any unnecessary low-privilege accounts, and restrict network access to SD-WAN Manager and Controller management interfaces to trusted administrator networks only. Within 7 days: deploy enhanced logging and real-time monitoring on all SD-WAN controllers to detect suspicious authentication patterns, privilege escalation attempts, and unauthorized configuration changes; implement web application firewall rules to filter malformed input to controller APIs. Within 30 days: establish formal escalation with Cisco for vulnerability remediation timeline and interim patch guidance; document current SD-WAN topology and access patterns to support future segmentation decisions; and conduct a forensic audit of all controller logs to identify any unauthorized access attempts.

Cisco Catalyst SD-WAN EUVD-2026-53469

| CVE-2026-20303 CRITICAL

Improper Input Validation (CWE-20)

2026-08-05 cisco

GHSA-px9f-qgqp-xvc4

Information Disclosure Cisco Cisco Catalyst Sd Wan Manager Cisco Catalyst Sd Wan Controller

9.9

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable management plane with only a low-privileged account (PR:L), low complexity, and a scope change (S:C) that exposes the broader control fabric to full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:24 vuln.today

CVE Published

Aug 05, 2026 - 16:29 nvd

CRITICAL 9.9

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.

AnalysisAI

Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller stems from improper input validation (CWE-20) discovered during Cisco's internal hardening review; an authenticated attacker with low privileges can send crafted input over the network to break out of their intended authorization scope and compromise the confidentiality, integrity, and availability of the management plane. The CVSS 9.9 score is driven by a scope change (S:C), meaning impact extends beyond the vulnerable component to the broader SD-WAN control fabric it orchestrates. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the near-maximal CVSS and the centrality of the affected controllers make this a high-priority patch.

Technical ContextAI

Cisco Catalyst SD-WAN (formerly Viptela) is Cisco's enterprise software-defined WAN fabric; the two affected components per CPE - cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller - are the management and control planes. SD-WAN Manager (formerly vManage) is the centralized GUI/API orchestration and policy server, while the SD-WAN Controller (formerly vSmart) distributes routing and policy (via OMP) to WAN edge routers. The root cause is CWE-20 (Improper Input Validation): the software accepts attacker-supplied data without adequately constraining its type, length, format, or semantic bounds before acting on it. Because these components govern an entire WAN's routing and segmentation policy, a validation failure here that changes scope (S:C) can let an authenticated session influence resources it should never reach, including other tenants, devices, or subsystems managed by the same controller.

RemediationAI

Upgrade to a fixed Cisco Catalyst SD-WAN Manager and Controller release as specified in the Cisco advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); this is a Cisco hardening-release bundle, so consult its Fixed Software table to map your current train (17.2.x/18.x/19.x/20.x/26.x) to the corresponding patched build rather than assuming a single version. No exact universal fix version is stated in the provided data, so cite the advisory's per-branch fixed releases and do not deploy a version number not listed there. Because exploitation requires an authenticated low-privileged account, effective compensating controls until patching are: restrict management-plane reachability so SD-WAN Manager/Controller GUI and API are accessible only from a dedicated out-of-band admin network or via jump host (trade-off: may disrupt automation/CI integrations that call the API directly); tighten and audit local and RBAC accounts to eliminate unneeded low-privilege logins and enforce strong authentication/MFA on the Manager (trade-off: administrative overhead); and monitor Manager/Controller logs for anomalous API calls or cross-scope access attempts. These reduce, but do not eliminate, exposure, since any retained low-privileged user remains a potential vector.