CVE-2026-20303
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Cisco Catalyst SD-WAN contains a vulnerability related to improper input validation (CWE-20). It was discovered during an internal security review and addressed in software hardening releases.
Risk Assessment
The vulnerability may allow an attacker to inject unexpected data, potentially leading to unauthorized actions or disruption of SD-WAN operations.
Recommendation
It is recommended to promptly apply the latest Cisco Catalyst SD-WAN software releases containing security fixes and monitor Cisco advisories for details.
Other vulnerabilities in Cisco Catalyst SD-WAN
See all- CVE-2026-20310Critical
Vulnerability in Cisco Catalyst SD-WAN related to improper link resolution before file access (CWE-59). Discovered during internal security review, addressed in a software hardening release.
- CVE-2026-20304Critical
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper access control (CWE-284) were discovered. A hardened software release addressing these issues has been issued.
- CVE-2026-20245HighActively exploited
A vulnerability in the CLI of Cisco Catalyst SD-WAN devices (Controller, Manager, Validator) allows an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. The issue is due to insufficient input validation. Cisco has observed limited exploitation resulting in configuration changes on edge devices.
- CVE-2026-20133MediumActively exploited
A vulnerability in Cisco Catalyst SD-WAN Software due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could access the vshell and read sensitive information from the underlying operating system.
- CVE-2026-20313High
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper link resolution before file access (CWE-1284) were discovered. Hardened software releases addressing these issues have been issued.
- CVE-2026-20312High
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to cleartext storage of sensitive information (CWE-312) were discovered. Hardened software releases addressing these issues have been issued.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.