EUVD-2026-53476
GHSA-r6pm-fp8r-q7p6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SD-WAN credentials
-
DeliveryConnect to network-accessible Manager or Controller
-
ExploitCraft request exploiting link resolution flaw
-
ExecutionTrigger improper file access path
-
PersistCause high-availability disruption
-
ImpactImpact cascades to SD-WAN fabric components
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Cisco Catalyst SD-WAN Manager or Controller (CVSS PR:L confirms authentication is required - unauthenticated exploitation is not supported by the CVSS vector). The management interface must be network-reachable from the attacker's position (AV:N). No user interaction is needed on the target side (UI:N), and attack complexity is low once credentials are held (AC:L). Limiting factors: (1) the PR:L requirement means an attacker must first obtain or possess a valid SD-WAN user account, preventing trivial unauthenticated mass exploitation; (2) the exact internal feature or file-access operation that triggers the vulnerability is not publicly disclosed; (3) the vulnerability was discovered internally by Cisco and no exploit code is public. The scope change (S:C) means the impact may extend to other SD-WAN components, but the triggering condition remains bounded to authenticated access to the Manager or Controller interface. |
| Impact | CVSS 3.1 base score of 7.7 (High) is driven by AV:N (network-reachable attack surface), AC:L (low complexity), PR:L (low privileges - some authentication required), UI:N (no user interaction), S:C (scope change), and A:H (high availability impact), with C:N and I:N indicating no confidentiality or integrity consequences per the CVSS vector. The scope change is a meaningful signal: exploitation may cascade availability disruption beyond the directly targeted Manager or Controller instance to dependent SD-WAN fabric components. However, two significant data conflicts reduce confidence in the risk profile: (1) the 'Information Disclosure' tag conflicts with the CVSS C:N metric - if confidentiality impact exists, the actual score and risk would be higher; (2) the described CWE (improper link resolution / file access) conflicts with the recorded CWE-1284. No EPSS score was provided, no CISA KEV listing exists, and no public exploit or POC has been identified. Cisco's self-disclosure via a proactive internal review suggests this is a hardening fix rather than a response to observed exploitation. Real-world priority is moderate: the PR:L requirement means unauthenticated attackers cannot directly trigger it, reducing automated exploitation risk, but any low-privileged SD-WAN user account could potentially weaponize it against the management plane. |
| Exploit ScenarioDerived | An attacker with a low-privileged SD-WAN user account - obtained through credential phishing, password reuse, or a compromised tenant account - connects to the network-accessible SD-WAN Manager or Controller interface and submits a crafted request that exploits improper link resolution in file access operations. The vulnerability triggers an availability disruption that, due to the S:C scope change, cascades beyond the targeted component and degrades SD-WAN fabric operations for connected sites. No public proof-of-concept exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated attacker over the network to cause high-availability impact with scope change - affecting resources beyond the directly targeted component. Discovered internally by Cisco's SD-WAN engineering team during a proactive security review and addressed in software hardening releases, this vulnerability is not confirmed as actively exploited (not in CISA KEV) and no public exploit code is known at time of analysis. The CVSS 7.7 (High) score reflects the combination of network accessibility, low authentication bar, no user interaction required, and high availability consequence with scope change.
RemediationAI
Apply the patched software releases identified in Cisco Security Advisory cisco-sa-hardening-sdwan-faLcR3K at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K - the advisory is the authoritative source for exact fixed release versions, as no specific fix version is enumerated in the available intelligence data. The patch availability is confirmed per Cisco's advisory (labeled as 'software hardening releases') but the precise fixed-version numbers were not independently confirmed in the input data and should be verified directly against the Cisco advisory before scheduling upgrades. As an interim compensating control, restrict access to the SD-WAN Manager and Controller management interfaces to only trusted, authorized IP ranges using ACLs or firewall rules, thereby reducing the network-accessible attack surface. Additionally, audit and minimize low-privileged SD-WAN user accounts to reduce the pool of credentials that could be leveraged for exploitation, noting that this does not eliminate the vulnerability but raises the effective exploitation bar. Restricting management-plane access has the trade-off of potentially impacting legitimate administrative workflows in distributed environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected components are the Cisco Catalyst SD-WAN Manager (the centralized management and orchestration plane) and the Cisco Catalyst SD-WAN Controller (the control plane component managing routing policy and fabric establishment), confirmed by CPE strings cpe:2.3:a:cisco:cisco_catalyst_sd-wan_controller and cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager. The CVE description attributes the root cause to 'Improper link resolution before file access' - behavior typically associated with CWE-59 (Link Following / Symlink attacks) - but the recorded CWE identifier in the advisory data is CWE-1284 (Improper Validation of Specified Quantity in Input). This discrepancy is a data quality issue: CWE-59 describes attacks where software follows symbolic or hard links to access unintended files, while CWE-1284 describes input quantity validation failures. The CVSS Scope:Changed metric indicates the vulnerability's impact extends beyond the directly vulnerable SD-WAN component to affect other resources in the environment. The tags also include 'Information Disclosure,' which conflicts with the CVSS C:N (no confidentiality impact) metric.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
PR:L confirmed by network-authenticated management access requirement; S:C and A:H reflect cascading availability impact beyond the directly targeted SD-WAN component.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20313 are related to Improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-1284.
Executive ViewAI
Cisco Catalyst SD-WAN Manager and Controller contain a high-severity availability vulnerability affecting network infrastructure resilience, with no vendor patch currently available. Authenticated attackers with low-privilege credentials can trigger service disruption that cascades beyond the directly targeted component, creating risk for organizations where insider threats or credential compromise could propagate network-wide outages.
Restrict network access to Catalyst SD-WAN Manager and Controller to authorized administrator IP ranges using firewall rules; enforce multi-factor authentication on all administrative access; implement role-based access controls enforcing least-privilege permissions; deploy continuous monitoring to detect unusual authentication patterns or unauthorized configuration changes; maintain isolated backup and recovery procedures independent of primary SD-WAN infrastructure; conduct quarterly reviews of user access permissions to minimize low-privilege account exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticat
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB