CVE-2026-20313
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper link resolution before file access (CWE-1284) were discovered. Hardened software releases addressing these issues have been issued.
Risk Assessment
These vulnerabilities may allow an attacker to access unauthorized files or perform file operations, potentially leading to system integrity compromise.
Recommendation
It is recommended to update Cisco Catalyst SD-WAN to the latest hardened version to mitigate the risk.
Other vulnerabilities in Cisco Catalyst SD-WAN
See all- CVE-2026-20310Critical
Vulnerability in Cisco Catalyst SD-WAN related to improper link resolution before file access (CWE-59). Discovered during internal security review, addressed in a software hardening release.
- CVE-2026-20304Critical
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper access control (CWE-284) were discovered. A hardened software release addressing these issues has been issued.
- CVE-2026-20303Critical
Cisco Catalyst SD-WAN contains a vulnerability related to improper input validation (CWE-20). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20245HighActively exploited
A vulnerability in the CLI of Cisco Catalyst SD-WAN devices (Controller, Manager, Validator) allows an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. The issue is due to insufficient input validation. Cisco has observed limited exploitation resulting in configuration changes on edge devices.
- CVE-2026-20312High
As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to cleartext storage of sensitive information (CWE-312) were discovered. Hardened software releases addressing these issues have been issued.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20313 are related to Improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-1284.