CVE-2026-20310

CriticalCVSS 9.1/10Last modified Oct 23, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco Catalyst SD-WAN Controller20.6.4; 20.9.2; 20.3.6; 20.7.2; 20.7.1; 20.5.1; 20.6.2; 19.3.0; 20.6.1; 17.2.4; 18.2.0; 18.4.6; 19.1.0; 19.2.4; 19.2.929; 18.3.8; 18.4.303; 18.3.7; 18.4.1; 19.2.097
CiscoCisco Catalyst SD-WAN Manager20.1.12; 19.2.1; 18.4.4; 18.4.5; 20.1.1.1; 20.1.1; 19.3.0; 19.2.2; 19.2.099; 18.3.6; 18.3.7; 19.2.0; 18.3.8; 19.0.0; 19.1.0; 18.4.302; 18.4.303; 19.2.097; 19.2.098; 17.2.10

References

Timeline

Published
Aug 5, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-203116.3A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privilCVE-2026-203128.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a CVE-2026-203137.7As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a CVE-2026-203145.0A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could aCVE-2026-2031510.0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a CVE-2026-203165.3A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attackCVE-2026-2031710.0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a CVE-2026-203189.6As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a CVE-2026-203197.5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a CVE-2026-20324.3Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the aCVE-2026-203207.5A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read seCVE-2026-203216.5A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated,