Cisco Catalyst Center Unauthenticated Path Traversal / Arbitrary File Read Vulnerability (CVE-2026-20191)
Cisco Catalyst Center Unauthenticated Path Traversal / (TL-2026-1071), also tracked as Cisco Catalyst Center Arbitrary File Read Vulnerability, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-07-02. It has no confirmed attribution, affects Cisco Catalyst Center (Hardware Appliance), references 1 CVE (CVE-2026-20191), maps to 19 MITRE ATT&CK techniques (T1005, T1016, T1046), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1071
- Threat ID
- TL-2026-1071
- Also known as
- Cisco Catalyst Center Arbitrary File Read Vulnerability, cisco-sa-catc-file-read-wLH2vf8X
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-02
- Last reviewed
- 2026-07-02
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, manufacturing, education, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
CVE-2026-20191 is a CWE-22 path traversal flaw (CVSS 7.5) in Cisco Catalyst Center's web interface that lets an unauthenticated remote attacker send crafted HTTP requests to read arbitrary files from a restricted container, potentially exposing configuration data and credentials. No public PoC or in-the-wild exploitation was reported at disclosure (2026-07-01); no workaround exists, so patching to fixed builds is mandatory.
How Cisco Catalyst Center Unauthenticated Path Traversal / works
Cisco disclosed CVE-2026-20191 on July 1, 2026 via advisory cisco-sa-catc-file-read-wLH2vf8X (Cisco Bug ID CSCwt73509), affecting Cisco Catalyst Center (formerly Cisco DNA Center), the vendor's SD-Access and network assurance management platform used to provision, monitor, and automate enterprise campus and branch networks. The vulnerability arises from insufficient validation of user-supplied input in the Catalyst Center web management interface, allowing an unauthenticated, remote attacker to craft HTTP requests containing directory-traversal sequences (e.g. '../') that escape the intended web-root or container filesystem boundary. Successful exploitation lets the attacker read arbitrary files accessible to the restricted container process -- potentially including application configuration files, internal credentials, TLS/service secrets, and other sensitive platform data -- without authenticating to the appliance first.
The flaw affects Catalyst Center version 3.1 on hardware appliances and virtual appliances hosted on AWS and Microsoft Azure, and versions 2.3.7 and 3.1 on VMware ESXi virtual appliances; versions prior to these release lines are not vulnerable. Cisco has published fixed software: 3.1.6 GSMU200 for hardware/AWS/Azure appliances, and either 2.3.7.11-VA GSMU100 or 3.1.6 GSMU200 for VMware ESXi deployments. There is no workaround -- the only remediation path is upgrading to a fixed release. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, no-privilege, no-user-interaction attack that yields a high confidentiality impact with no integrity or availability impact -- consistent with a read-only information-disclosure primitive rather than a full remote-code-execution chain. Cisco states the issue was found internally during a support case investigation, not by an external researcher or in response to observed attacker activity, and reports no known public proof-of-concept exploit code and no confirmed active exploitation as of disclosure.
Because Catalyst Center is a centralized management plane with broad visibility and control over enterprise network fabric (SD-Access, wireless, assurance, automation), any credential or configuration-file disclosure obtained via this flaw could materially assist a follow-on attacker in pivoting toward network device management access, API tokens, or integrated identity/AAA secrets stored on the appliance. Given Cisco's Catalyst Center and DNA Center product line has a documented history of file-read, privilege-escalation, and RCE advisories in the same release train, and because unauthenticated network-facing management interfaces are a persistent target for opportunistic internet scanning, defenders should treat this as a high-priority patch item even absent confirmed in-the-wild exploitation, and should restrict management-plane exposure per Cisco's long-standing guidance to never expose Catalyst Center's web interface directly to the internet.
MITRE ATT&CK techniques used in TL-2026-1071
Collection
T1005 Data from Local System; T1602 Data from Configuration Repository
Discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material
Impact
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
Reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in Cisco Catalyst Center Unauthenticated Path Traversal /
- Cisco — Catalyst Center (Hardware Appliance)
Vulnerable versions: 3.1
Fixed in: 3.1.6 GSMU200 - Cisco — Catalyst Center Virtual Appliance (AWS)
Vulnerable versions: 3.1
Fixed in: 3.1.6 GSMU200 - Cisco — Catalyst Center Virtual Appliance (Microsoft Azure)
Vulnerable versions: 3.1
Fixed in: 3.1.6 GSMU200 - Cisco — Catalyst Center Virtual Appliance (VMware ESXi)
Vulnerable versions: 2.3.7; 3.1
Fixed in: 2.3.7.11-VA GSMU100; 3.1.6 GSMU200
Remediation for Cisco Catalyst Center Unauthenticated Path Traversal /
Patches
- Cisco Catalyst Center 3.1.6 GSMU200 (hardware, AWS, Azure)
- Cisco Catalyst Center 2.3.7.11-VA GSMU100 (VMware ESXi)
- Cisco Catalyst Center 3.1.6 GSMU200 (VMware ESXi, alternate fixed train)
Immediate actions
- Upgrade Cisco Catalyst Center hardware/AWS/Azure virtual appliances to fixed release 3.1.6 GSMU200
- Upgrade Cisco Catalyst Center VMware ESXi virtual appliances to 2.3.7.11-VA GSMU100 or 3.1.6 GSMU200
- Restrict all network access to the Catalyst Center management interface to trusted management VLANs / jump hosts only
- Audit external/internet-facing exposure of Catalyst Center instances immediately (Shodan/Censys-style self-scan)
- Review appliance logs for anomalous HTTP requests containing path-traversal sequences ('../', encoded variants) against the web interface
Longer-term hardening
- Deploy network segmentation isolating network-management-plane appliances (Catalyst Center, ISE, SD-WAN Manager) from general enterprise and internet-routable segments
- Implement a patch-management SLA for Cisco network management platforms given their recurring history of file-read/RCE advisories
- Enable centralized logging/SIEM forwarding from Catalyst Center for HTTP access-log anomaly detection
- Periodically rotate credentials and API tokens stored on/managed by Catalyst Center in case of undetected historical exposure
CVEs associated with Cisco Catalyst Center Unauthenticated Path Traversal /
Weaknesses (CWE) in Cisco Catalyst Center Unauthenticated Path Traversal /
CWE-22
Timeline of Cisco Catalyst Center Unauthenticated Path Traversal /
- Cisco publishes a separate, unrelated Catalyst Center cross-site scripting advisory (cisco-sa-dnac-xss-weXtVZ59), indicating an active internal PSIRT review cadence on the Catalyst Center platform in the months preceding CVE-2026-20191.
- Cisco publishes the Catalyst Center Virtual Appliance Privilege Escalation advisory (cisco-sa-catc-priv-esc-VS8EeCuX), part of the same platform-hardening advisory wave that later includes CVE-2026-20191.
- Cisco identifies CVE-2026-20191 internally during a support case investigation of the Catalyst Center platform, not via external researcher report or in-the-wild detection.
- Cisco concurrently discloses the Catalyst Center REST API Command Injection vulnerability (cisco-sa-dnac-ci-ZWLQVSwT), allowing an authenticated attacker with at least Observer role to execute arbitrary commands as root in a restricted container -- a materially more severe companion flaw on the same product line published alongside the file-read issue.
- Cisco makes fixed builds available: 3.1.6 GSMU200 for hardware/AWS/Azure appliances and 2.3.7.11-VA GSMU100 or 3.1.6 GSMU200 for VMware ESXi virtual appliances.
- Cisco publishes security advisory cisco-sa-catc-file-read-wLH2vf8X disclosing CVE-2026-20191, an unauthenticated path traversal / arbitrary file read vulnerability in Catalyst Center, alongside Bug ID CSCwt73509 and fixed software releases.
- Threadlinqs Intelligence Platform ingests the advisory via RSS hunt pipeline and opens threat record TL-2026-1071 for tracking and detection-engineering follow-up.
- CISA Known Exploited Vulnerabilities catalog checked and does not list CVE-2026-20191 as of this date, consistent with Cisco's statement of no known active exploitation.
- Cyber Security News publishes coverage of the vulnerability, summarizing the advisory for a wider security-practitioner audience.
Sources cited for Cisco Catalyst Center Unauthenticated Path Traversal /
- Cisco Security Advisory: Cisco Catalyst Center Arbitrary File Read Vulnerability (cisco-sa-catc-file-read-wLH2vf8X)
- Cisco Catalyst Center Vulnerability Allows Attackers To Read Files From Restricted Systems
- NVD - CVE-2026-20191 Detail
- Cisco Catalyst Center product support page
- CISA Known Exploited Vulnerabilities Catalog (queried for CVE-2026-20191 -- not listed)
- Cisco Security Advisory: Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability (related platform advisory)
- Cisco Security Advisory: Cisco Catalyst Center Cross-Site Scripting Vulnerability (related platform advisory)
- Cisco Security Advisory: Cisco Catalyst Center REST API Command Injection Vulnerability (related, concurrently disclosed platform advisory)
- Cisco Catalyst Center - Security Advisories, Responses and Notices (full advisory index)
Threats related to Cisco Catalyst Center Unauthenticated Path Traversal /
- CVE-2026-16232: Check Point SmartConsole Authentication Bypass Actively Exploited, Added to CISA KEV
- CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)
- CVE-2026-46817: Unauthenticated Arbitrary File Read in Oracle E-Business Suite Payments File Transmission Exploited Before Public PoC
- GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation
- CVE-2026-4020: Gravity SMTP WordPress Plugin Unauthenticated System-Report Credential Disclosure (Actively Exploited)
- Ubiquiti UniFi OS — Three Max-Severity Pre-Auth Vulnerabilities (CVE-2026-34908 / 34909 / 34910) in Security Advisory Bulletin 064
Detection coverage for TL-2026-1071
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1071 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.