What is the CVSS score of EUVD-2026-53471?

EUVD-2026-53471 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Cisco Catalyst SD-WAN are affected by EUVD-2026-53471?

Cisco Catalyst SD-WAN Manager and SD-WAN Controller contain a critical file-manipulation vulnerability (CVE-2026-20310, CVSS 9.1) that allows authenticated users to read, modify, or delete files…

How to fix or mitigate EUVD-2026-53471?

Within 24 hours, inventory all Cisco SD-WAN Manager and Controller instances in production, document current versions, and verify that management-plane access is restricted to trusted administrative personnel only. Over the next 7 days, implement network segmentation and firewall rules to limit management-plane access to authorized networks, enable file-system audit logging to detect suspicious access patterns, and establish an escalation procedure for file-integrity incidents. Within 30 days, monitor Cisco's security advisories for patch release; upon availability, test the fix in staging immediately and deploy to all production instances within a planned maintenance window.

Cisco Catalyst SD-WAN EUVD-2026-53471

| CVE-2026-20310 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-08-05 cisco

GHSA-fhhx-46fx-737r

Information Disclosure Cisco Cisco Catalyst Sd Wan Manager Cisco Catalyst Sd Wan Controller

9.1

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Reachable over the management network at low complexity but gated by administrative access (PR:H); symlink abuse crosses a host boundary (S:C) enabling file read, overwrite, and destruction (C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:22 vuln.today

CVE Published

Aug 05, 2026 - 16:30 nvd

CRITICAL 9.1

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.

AnalysisAI

Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to abuse improper symbolic-link resolution (CWE-59) to read, overwrite, or destroy files outside intended boundaries, with a scope-changing impact that reaches beyond the vulnerable process. The flaw was found during Cisco's internal SD-WAN security review and remediated in hardening releases; it carries a CVSS 9.1 rating driven by network reach, low complexity, and high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and management-plane exposure make it a meaningful patching priority.

Technical ContextAI

Cisco Catalyst SD-WAN (formerly Viptela) is Cisco's software-defined WAN fabric; SD-WAN Manager (vManage) is the centralized management/orchestration controller and SD-WAN Controller (vSmart) distributes control-plane policy to edge routers. The CPE data confirms the two affected components are cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller. The root cause is CWE-59, improper link resolution before file access (a link-following / symlink flaw): the software follows a filesystem link without validating its target, so an operation intended for a controlled path can be redirected to an arbitrary file. On an appliance where the attacker already holds privileged access, this lets file operations escape their intended directory, and the CVSS scope change (S:C) indicates the impact crosses a security boundary of the underlying host or another component.

RemediationAI

Upgrade to the fixed SD-WAN Manager and SD-WAN Controller releases identified in Cisco advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K); patch available per vendor advisory, but no single exact fixed version string is included in the provided data, so consult the advisory's fixed-release table to map your current train (17.2.x/18.x/19.x/20.x/26.1.x) to its patched build. Because exploitation requires high privileges, the most effective compensating controls until you can patch are to tightly restrict and audit administrative access to SD-WAN Manager and Controller: limit management-plane reachability to a dedicated out-of-band management network or jump host (trade-off: may complicate remote administration), enforce strong role-based access control and MFA on all vManage/vSmart admin accounts to shrink the pool of principals who could reach PR:H (trade-off: operational overhead), and monitor for unexpected file or symlink activity and configuration changes on the appliances. Do not rely on network filtering alone as a substitute for the patch, since the flaw is exploitable by legitimate privileged users.