Forwarded Taiwan Computer Network Emergency Response Team/Coordination Center Information Security Alert TWCERTCC-200-202608-00000005
[Content Description]
Cisco Catalyst SD-WAN is Cisco's cloud-centric software-defined wide area network architecture, providing centralized management, secure encryption, and application performance optimization to ensure reliable connectivity in multi-cloud environments. The Catalyst SD-WAN software development team discovered multiple security vulnerabilities during an internal security review and has completed remediation.
Currently, there is no evidence that these vulnerabilities have been actively exploited. To help customers deploy security updates in a timely manner and simplify the vulnerability disclosure process, Cisco has publicly disclosed the relevant vulnerability information and remediation recommendations.
CVE-2026-20303(CVSS: 9.9) is an Improper Input Validation vulnerability; CVE-2026-20304(CVSS: 9.9) is an Improper Access Control vulnerability; CVE-2026-20310(CVSS: 9.9) is an Incorrect Link Resolution Before File Access vulnerability; CVE-2026-20312(CVSS: 8.8) is an Exposure of Sensitive Information in Cleartext vulnerability.
[Impacted Platform]
Cisco Catalyst SD-WAN versions 20.9(inclusive) and earlier, Cisco Catalyst SD-WAN version 20.10, Cisco Catalyst SD-WAN version 20.11, Cisco Catalyst SD-WAN version 20.12, Cisco Catalyst SD-WAN version 20.13, Cisco Catalyst SD-WAN version 20.14, Cisco Catalyst SD-WAN version 20.15, Cisco Catalyst SD-WAN version 20.16, Cisco Catalyst SD-WAN version 20.18, Cisco Catalyst SD-WAN version 26.1
[Recommended Actions]
Please update to the following versions: Cisco Catalyst SD-WAN 20.9.10(inclusive) or later versions, Cisco Catalyst SD-WAN 20.12.8.1(inclusive) or later versions, Cisco Catalyst SD-WAN 20.15.6(inclusive) or later versions, Cisco Catalyst SD-WAN 20.18.4(inclusive) or later versions, Cisco Catalyst SD-WAN 26.1.2(inclusive) or later versions
[Reference]
1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-sdwan-faLcR3K
2. https://nvd.nist.gov/vuln/detail/CVE-2026-20303
3. https://nvd.nist.gov/vuln/detail/CVE-2026-20304
4. https://nvd.nist.gov/vuln/detail/CVE-2026-20310
5. https://nvd.nist.gov/vuln/detail/CVE-2026-20312