# Cisco Catalyst Center Unauthenticated Path Traversal / Arbitrary File Read Vulnerability (CVE-2026-20191)

> CVE-2026-20191 is a CWE-22 path traversal flaw (CVSS 7.5) in Cisco Catalyst Center's web interface that lets an unauthenticated remote attacker send crafted HTTP requests to read arbitrary files from a restricted container, potentially exposing configuration data and credentials. No public PoC or in-the-wild exploitation was reported at disclosure (2026-07-01); no workaround exists, so patching to fixed builds is mandatory.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1071
- **ID:** TL-2026-1071
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20191

## Description

Cisco disclosed CVE-2026-20191 on July 1, 2026 via advisory cisco-sa-catc-file-read-wLH2vf8X (Cisco Bug ID CSCwt73509), affecting Cisco Catalyst Center (formerly Cisco DNA Center), the vendor's SD-Access and network assurance management platform used to provision, monitor, and automate enterprise campus and branch networks. The vulnerability arises from insufficient validation of user-supplied input in the Catalyst Center web management interface, allowing an unauthenticated, remote attacker to craft HTTP requests containing directory-traversal sequences (e.g. '../') that escape the intended web-root or container filesystem boundary. Successful exploitation lets the attacker read arbitrary files accessible to the restricted container process -- potentially including application configuration files, internal credentials, TLS/service secrets, and other sensitive platform data -- without authenticating to the appliance first.

The flaw affects Catalyst Center version 3.1 on hardware appliances and virtual appliances hosted on AWS and Microsoft Azure, and versions 2.3.7 and 3.1 on VMware ESXi virtual appliances; versions prior to these release lines are not vulnerable. Cisco has published fixed software: 3.1.6 GSMU200 for hardware/AWS/Azure appliances, and either 2.3.7.11-VA GSMU100 or 3.1.6 GSMU200 for VMware ESXi deployments. There is no workaround -- the only remediation path is upgrading to a fixed release. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, no-privilege, no-user-interaction attack that yields a high confidentiality impact with no integrity or availability impact -- consistent with a read-only information-disclosure primitive rather than a full remote-code-execution chain. Cisco states the issue was found internally during a support case investigation, not by an external researcher or in response to observed attacker activity, and reports no known public proof-of-concept exploit code and no confirmed active exploitation as of disclosure.

Because Catalyst Center is a centralized management plane with broad visibility and control over enterprise network fabric (SD-Access, wireless, assurance, automation), any credential or configuration-file disclosure obtained via this flaw could materially assist a follow-on attacker in pivoting toward network device management access, API tokens, or integrated identity/AAA secrets stored on the appliance. Given Cisco's Catalyst Center and DNA Center product line has a documented history of file-read, privilege-escalation, and RCE advisories in the same release train, and because unauthenticated network-facing management interfaces are a persistent target for opportunistic internet scanning, defenders should treat this as a high-priority patch item even absent confirmed in-the-wild exploitation, and should restrict management-plane exposure per Cisco's long-standing guidance to never expose Catalyst Center's web interface directly to the internet.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1190 Exploit Public-Facing Application
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1210 Exploitation of Remote Services
- T1550 Use Alternate Authentication Material
- T1588 Obtain Capabilities
- T1518 Software Discovery
- T1069 Permission Groups Discovery
- T1068 Exploitation for Privilege Escalation
- T1059 Command and Scripting Interpreter
- T1071 Application Layer Protocol
- T1489 Service Stop

## Sources

- [Cisco Security Advisory: Cisco Catalyst Center Arbitrary File Read Vulnerability (cisco-sa-catc-file-read-wLH2vf8X)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-file-read-wLH2vf8X)
- [Cisco Catalyst Center Vulnerability Allows Attackers To Read Files From Restricted Systems](https://cybersecuritynews.com/cisco-catalyst-center-vulnerability-attackers/)
- [NVD - CVE-2026-20191 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-20191)
- [Cisco Catalyst Center product support page](https://www.cisco.com/c/en/us/support/cloud-systems-management/dna-center/series.html)
- [CISA Known Exploited Vulnerabilities Catalog (queried for CVE-2026-20191 -- not listed)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Cisco Security Advisory: Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability (related platform advisory)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catc-priv-esc-VS8EeCuX)
- [Cisco Security Advisory: Cisco Catalyst Center Cross-Site Scripting Vulnerability (related platform advisory)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-dnac-xss-weXtVZ59.html)
- [Cisco Security Advisory: Cisco Catalyst Center REST API Command Injection Vulnerability (related, concurrently disclosed platform advisory)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-ci-ZWLQVSwT)
- [Cisco Catalyst Center - Security Advisories, Responses and Notices (full advisory index)](https://www.cisco.com/c/en/us/support/cloud-systems-management/dna-center/products-security-advisories-list.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1071