CVE-2026-20191: Cisco Catalyst Center Arbitrary File Read Vulnerability

Technical summary

CVE-2026-20191 is a path traversal vulnerability (CWE-22) in Cisco Catalyst Center stemming from inadequate input validation. The application fails to properly sanitize user-supplied input in HTTP requests, enabling unauthenticated remote attackers to traverse directory boundaries and read arbitrary files from a restricted container. The vulnerability is network-accessible, requires no authentication or user interaction, and has a CVSS v3.1 score of 7.5 (HIGH), indicating high confidentiality impact but no integrity or availability impact.

Business impact

Compromise of sensitive operational and configuration data within Catalyst Center could expose network topology details, credentials, API keys, authentication tokens, and other sensitive administrative information. This disclosure may facilitate further attacks against network infrastructure managed by the Center. Organizations relying on Catalyst Center for network automation and management face potential unauthorized intelligence gathering about their infrastructure without detection or system compromise at the operational level.

Affected systems

Cisco Catalyst Center deployments are affected. Organizations should consult Cisco's security advisories to determine the specific versions impacted and verify the scope of exposure within their environment. The vulnerability does not require special network positioning or configuration; any system with network access to an affected Catalyst Center instance is at risk.

Exploitability

This vulnerability presents a relatively low barrier to exploitation. It requires only network connectivity and the ability to craft an HTTP request—no authentication, no special tools, and no user interaction needed. The attack surface is the HTTP interface of Catalyst Center itself. However, practical exploitation depends on the attacker's knowledge of file paths and access to network routes that reach the affected system. There is no indication this vulnerability is currently being actively exploited in the wild.

Remediation

Organizations should apply security patches released by Cisco for this vulnerability. Consult Cisco's official security advisories for affected version numbers and corresponding patch versions. Until patching is completed, network segmentation and access controls should restrict connectivity to Catalyst Center management interfaces to trusted administrative networks and hosts only.

Patch guidance

Verify the current version of Cisco Catalyst Center running in your environment. Review Cisco's official security advisory for CVE-2026-20191 to identify which versions are affected and which versions contain the fix. Apply the recommended patch version from Cisco without delay, prioritizing systems in production or managing critical infrastructure. After patching, validate that the system functions as expected and that input validation is now functioning correctly.

Detection guidance

Monitor HTTP request logs for Catalyst Center for unusual or suspicious patterns in user input, particularly those containing path traversal sequences (e.g., '../', '..\', or encoded variants). Implement alerting on HTTP 400/403 errors that may indicate failed exploitation attempts. Consider deploying a Web Application Firewall (WAF) rule set that detects and blocks path traversal payloads. Audit file access logs within Catalyst Center containers for unexpected reads of sensitive files by unauthenticated sessions.

Why prioritize this

The combination of network accessibility, lack of authentication requirement, and high confidentiality impact (CVSS 7.5) makes this a priority remediation target. Unpatched instances are immediately exploitable by any attacker with network access. The exposure of configuration and credential data could enable lateral movement and further compromise of network infrastructure. This should be treated as a critical security gap in any production Catalyst Center deployment.

Risk score, explained

CVSS v3.1 score of 7.5 (HIGH) reflects: (1) Network-accessible attack vector with no authentication or user interaction required; (2) Low attack complexity—straightforward HTTP request exploitation; (3) High confidentiality impact due to unrestricted file read capability; (4) No integrity or availability impact. The score appropriately weights the ease of exploitation and severity of information disclosure against the lack of system-level compromise.

Frequently asked questions