CVE-2026-20303

Published Aug 5, 2026

Last updated 4 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20303 identifies a collection of vulnerabilities within Cisco Catalyst SD-WAN Software, primarily stemming from improper input validation issues. These vulnerabilities are grouped under the Common Weakness Enumeration (CWE) CWE-20, representing a change in Cisco's typical disclosure approach where multiple underlying security defects are consolidated under a single CVE based on their common weakness class. This particular grouping encompasses problems such as input validation failures, path traversal, and external path control. The affected software includes Cisco Catalyst SD-WAN deployments across on-premises, Cisco SD-WAN Cloud-Pro, Cisco-managed SD-WAN Cloud, and Cisco SD-WAN for Government environments, regardless of device configuration. Cisco has released software hardening updates to address these internally discovered vulnerabilities, and no workarounds are available.

Description: As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
Source: psirt@cisco.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@cisco.com: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References