Severity
High
Analysis Summary
Cisco has disclosed a high-severity security vulnerability, CVE-2026-20191 (CVSS score high), affecting its Cisco Catalyst Center platform, formerly known as Cisco DNA Center. The flaw is classified as CWE-22 (Path Traversal) and results from improper validation of user-supplied input within the Catalyst Center web interface. By sending a specially crafted HTTP request, an unauthenticated remote attacker can exploit the vulnerability to read arbitrary files from a restricted container environment on the affected system. While the vulnerability does not permit data modification or service disruption, it poses a serious confidentiality risk because attackers may gain access to sensitive files, configuration data, credentials, and other system information that could facilitate further attacks or lateral movement within enterprise networks.
The vulnerability impacts a broad range of Cisco Catalyst Center deployments, including both hardware appliances and virtual installations running on Amazon Web Services (AWS), Microsoft Azure, and VMware ESXi, regardless of system configuration. Cisco confirmed that versions earlier than 3.1 are not affected, while vulnerable releases have been addressed through security updates. The issue is fixed in Catalyst Center 3.1.6 GSMU200 and VMware ESXi deployments running 2.3.7.11-VA GSMU100 (for version 2.3.7) and 3.1.6 GSMU200 (for version 3.1). Importantly, Cisco stated that no workarounds or temporary mitigations are available, making immediate installation of the official software updates the only effective remediation.
According to Cisco's Product Security Incident Response Team (PSIRT), there is no evidence of active exploitation, no publicly available proof-of-concept exploit, and no known attack campaigns targeting this vulnerability at the time of disclosure. The flaw was identified internally during the investigation of a Cisco Technical Assistance Center (TAC) support case rather than through reports of malicious activity. Despite the absence of observed attacks, the vulnerability remains a significant concern because it requires no authentication and can be exploited using relatively simple crafted HTTP requests, reducing the technical barrier for potential attackers once exploit details become public.
Organizations using Cisco Catalyst Center should treat this vulnerability as a high-priority security issue and deploy the recommended software updates without delay. In addition to patching, administrators should restrict external access to Catalyst Center management interfaces, enforce network segmentation to isolate management systems from untrusted networks, and continuously monitor logs for suspicious HTTP requests that may indicate attempts to access unauthorized file paths. Regular security audits, strong access controls, and proactive monitoring will further reduce the risk of compromise and help protect sensitive enterprise network management infrastructure from potential exploitation.
Impact
- Sensitive Data Theft
- Gain Access
Indicators of Compromise
CVE
- CVE-2026-20191
Remediation
- Apply Cisco security updates immediately by upgrading all affected Cisco Catalyst Center deployments to the fixed versions (Catalyst Center 3.1.6 GSMU200 or the appropriate VMware ESXi GSMU release) as recommended by Cisco.
- Restrict access to Catalyst Center management interfaces by ensuring they are not directly accessible from the public internet and limiting access to trusted administrative networks only.
- Implement network segmentation to isolate network management infrastructure from user and production networks, reducing the risk of lateral movement if a system is compromised.
- Enforce strong access controls by applying the principle of least privilege, using role-based access control (RBAC), and enabling multi-factor authentication (MFA) for administrative accounts wherever possible.
- Continuously monitor HTTP access logs and security monitoring tools for suspicious requests, particularly those attempting to access unauthorized or sensitive file paths.
- Perform regular vulnerability assessments and security audits to identify exposed Catalyst Center instances and verify that security updates have been successfully applied.
- Maintain secure configurations by protecting sensitive configuration files and credentials, and regularly rotating privileged credentials as part of routine security hygiene.