What is the CVSS score of EUVD-2026-53476?

EUVD-2026-53476 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco Catalyst SD-WAN are affected by EUVD-2026-53476?

Cisco Catalyst SD-WAN Manager and Controller contain a high-severity availability vulnerability affecting network infrastructure resilience, with no vendor patch currently available.

How to fix or mitigate EUVD-2026-53476?

Within 24 hours: Conduct immediate inventory of all Catalyst SD-WAN Manager and Controller deployments; restrict network access to only essential administrators and systems; enable enhanced logging on authentication events and configuration changes. Within 7 days: Implement network segmentation isolating SD-WAN management infrastructure from general-access networks; audit all low-privilege user accounts with access to these systems and enforce multi-factor authentication for administrative access; establish real-time monitoring for unusual SD-WAN Controller behavior or anomalous login patterns. Within 30 days: Contact Cisco directly to confirm patch availability timeline and obtain security guidance specific to your deployment version; develop and test a controlled upgrade strategy for affected systems; conduct credential rotation for all accounts accessing Catalyst SD-WAN infrastructure as a defense-in-depth measure.

Cisco Catalyst SD-WAN EUVD-2026-53476

| CVE-2026-20313 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-08-05 cisco

GHSA-r6pm-fp8r-q7p6

Information Disclosure Cisco Cisco Catalyst Sd Wan Manager Cisco Catalyst Sd Wan Controller

7.7

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

PR:L confirmed by network-authenticated management access requirement; S:C and A:H reflect cascading availability impact beyond the directly targeted SD-WAN component.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:22 vuln.today

CVE Published

Aug 05, 2026 - 16:33 nvd

HIGH 7.7

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20313 are related to Improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-1284.

AnalysisAI

Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated attacker over the network to cause high-availability impact with scope change - affecting resources beyond the directly targeted component. Discovered internally by Cisco's SD-WAN engineering team during a proactive security review and addressed in software hardening releases, this vulnerability is not confirmed as actively exploited (not in CISA KEV) and no public exploit code is known at time of analysis. The CVSS 7.7 (High) score reflects the combination of network accessibility, low authentication bar, no user interaction required, and high availability consequence with scope change.

Technical ContextAI

The affected components are the Cisco Catalyst SD-WAN Manager (the centralized management and orchestration plane) and the Cisco Catalyst SD-WAN Controller (the control plane component managing routing policy and fabric establishment), confirmed by CPE strings cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager. The CVE description attributes the root cause to 'Improper link resolution before file access' - behavior typically associated with CWE-59 (Link Following / Symlink attacks) - but the recorded CWE identifier in the advisory data is CWE-1284 (Improper Validation of Specified Quantity in Input). This discrepancy is a data quality issue: CWE-59 describes attacks where software follows symbolic or hard links to access unintended files, while CWE-1284 describes input quantity validation failures. The CVSS Scope:Changed metric indicates the vulnerability's impact extends beyond the directly vulnerable SD-WAN component to affect other resources in the environment. The tags also include 'Information Disclosure,' which conflicts with the CVSS C:N (no confidentiality impact) metric.

RemediationAI

Apply the patched software releases identified in Cisco Security Advisory cisco-sa-hardening-sdwan-faLcR3K at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K - the advisory is the authoritative source for exact fixed release versions, as no specific fix version is enumerated in the available intelligence data. The patch availability is confirmed per Cisco's advisory (labeled as 'software hardening releases') but the precise fixed-version numbers were not independently confirmed in the input data and should be verified directly against the Cisco advisory before scheduling upgrades. As an interim compensating control, restrict access to the SD-WAN Manager and Controller management interfaces to only trusted, authorized IP ranges using ACLs or firewall rules, thereby reducing the network-accessible attack surface. Additionally, audit and minimize low-privileged SD-WAN user accounts to reduce the pool of credentials that could be leveraged for exploitation, noting that this does not eliminate the vulnerability but raises the effective exploitation bar. Restricting management-plane access has the trade-off of potentially impacting legitimate administrative workflows in distributed environments.