Paper/Archive/CVE-2026-20310

CVE-2026-20310

Cisco Cisco Catalyst SD-WAN Controller — Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 48.1.481 × 209.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.

Affected

ProductAffectedFixed inSource

Cisco Catalyst SD-WAN Controller20.6.4–CNA

Cisco Catalyst SD-WAN Controller20.9.2–CNA

Cisco Catalyst SD-WAN Controller20.3.6–CNA

Cisco Catalyst SD-WAN Controller20.7.2–CNA

Cisco Catalyst SD-WAN Controller20.7.1–CNA

Cisco Catalyst SD-WAN Controller20.5.1–CNA

Cisco Catalyst SD-WAN Controller20.6.2–CNA

Cisco Catalyst SD-WAN Controller19.3.0–CNA

Cisco Catalyst SD-WAN Controller20.6.1–CNA

Cisco Catalyst SD-WAN Controller17.2.4–CNA

Cisco Catalyst SD-WAN Controller18.2.0–CNA

Cisco Catalyst SD-WAN Controller18.4.6–CNA

Scores by source

cisco (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K refcve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification