What is the CVSS score of EUVD-2026-53472?

EUVD-2026-53472 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco Catalyst SD-WAN are affected by EUVD-2026-53472?

Cisco Catalyst SD-WAN Controller and Manager versions 17.2.x through 20.14.x store sensitive credentials in cleartext, exposing authenticated network users to extract credentials that could…

How to fix or mitigate EUVD-2026-53472?

Within 24 hours: Inventory all Cisco Catalyst SD-WAN Controller and Manager instances in your environment and identify which are running versions 17.2.x through 20.14.x; document the network accessibility of each affected system and which users or systems can authenticate to them. Within 7 days: Implement network segmentation and firewall rules to restrict access to affected controllers and managers to only essential administrative users and systems; rotate all credentials for control plane access immediately; enable detailed logging and alerting on authentication attempts to these systems. Within 30 days: Monitor Cisco security advisories for patch availability; upon release, test the patch in a non-production environment and execute a staged deployment plan to upgrade all affected instances.

Cisco Catalyst SD-WAN EUVD-2026-53472

| CVE-2026-20312 HIGH

Cleartext Storage of Sensitive Information (CWE-312)

2026-08-05 cisco

GHSA-5gw4-ww4c-vqvv

Information Disclosure Cisco Cisco Catalyst Sd Wan Manager Cisco Catalyst Sd Wan Controller

8.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

CWE-312 directly causes confidentiality loss via credential exposure; integrity impact is indirect and availability is not directly attributable to the storage flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:23 vuln.today

CVE Published

Aug 05, 2026 - 16:31 nvd

HIGH 8.8

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20312 are related to Cleartext storage of sensitive information issues that are grouped under the Common Weakness Enumeration (CWE) CWE-312.

AnalysisAI

Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other security-critical data to authenticated network-accessible attackers, with CVSS 8.8 reflecting the high potential for full system compromise via stolen credentials. Affecting an extraordinarily wide version range spanning 17.2.x through 20.14.x across both the Controller and Manager components, this vulnerability was discovered internally by Cisco's engineering team - a positive signal indicating no known prior adversarial exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the SD-WAN control plane sensitivity means exposed credentials could enable broad network infrastructure takeover.

Technical ContextAI

Cisco Catalyst SD-WAN is an enterprise software-defined WAN fabric consisting of two primary control-plane components: the SD-WAN Controller (formerly vSmart, responsible for policy distribution and OMP routing) and the SD-WAN Manager (formerly vManage, the centralized orchestration and configuration GUI). CWE-312 (Cleartext Storage of Sensitive Information) describes the root cause: security-critical data - typically credentials, API keys, shared secrets, or private keys - is persisted in storage (database, file system, configuration store) without encryption or strong hashing, making it readable to any process or user with storage-level read access. In the SD-WAN context, exposed controller or manager credentials are particularly dangerous because these components hold the policy and routing keys for the entire WAN overlay. The CPE data confirms affected software is cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager with wildcard version scope, corroborated by EUVD-2026-53472 listing hundreds of discrete versions from 17.2.4 through 20.14.1.

RemediationAI

Consult the Cisco Security Advisory cisco-sa-hardening-sdwan-faLcR3K (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K) for exact fixed software versions - specific patched releases are not enumerated in the available data and should not be inferred. The advisory describes these as 'software hardening releases,' indicating the fix involves encrypting or otherwise protecting sensitive data at rest rather than a simple code patch. As compensating controls while patching is scheduled: restrict management-plane access to the SD-WAN Manager and Controller to dedicated out-of-band administrative VLANs or jump hosts, reducing the network attack surface for PR:L exploitation. Audit role-based access control to ensure the minimum required accounts have access to Manager and Controller APIs, limiting the pool of accounts that could be used for exploitation. After patching, rotate all credentials, API tokens, and secrets that may have been stored in the affected components, as previously stored values may have been exposed.