CVE-2026-20310

Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access

At a glance

Severity: CRITICAL 9.1
EPSS: EPSS 0.59 % · percentile 48 (2026-10-27)
State: PUBLISHED
Published: 2026-08-05
Updated: 2026-08-14
Assigner: cisco
NVD status: Awaiting Analysis

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	cisco
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · psirt@cisco.com (Secondary)

Weaknesses (CWE)

CWE-59

European references

ENISA EUVD · EUVD-2026-53471
GCVE · GCVE-0-2026-20310

CERT-FR advisories

CERTFR-2026-AVI-0975 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr

Affected products

Product	Versions
Cisco · Cisco Catalyst SD-WAN Controller	affected 20.6.4 ; affected 20.9.2 ; affected 20.3.6 ; affected 20.7.2 ; affected 20.7.1 ; affected 20.5.1
Cisco · Cisco Catalyst SD-WAN Manager	affected 20.1.12 ; affected 19.2.1 ; affected 18.4.4 ; affected 18.4.5 ; affected 20.1.1.1 ; affected 20.1.1

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD