CRITICAL CWE-284
CVE-2026-20304
Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities
Cisco·Catalyst SD-WAN Controller
9.9/ 10
CVSS 3.1
Critical severity
0.42%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 37% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Aug 5, 2026
- Updated
- Aug 14, 2026
- First covered
- Aug 6, 2026
- Latest story
- 3 months ago
Summary
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities.The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
CWE-284Improper Access Control
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesLow
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HAffected products
- Cisco Catalyst SD-WAN Controller20.6.420.9.220.3.620.7.2
- Cisco Catalyst SD-WAN Manager20.1.1219.2.118.4.418.4.5