CVE-2026-20191
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated File Read in Cisco Catalyst Center

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Cisco Systems, Inc.

Description
A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container.  This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read arbitrary files from a restricted container of the affected device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-21
AI Q&A
2026-07-01
EPSS Evaluated
2026-07-20
NVD
CVE-2026-20191
EUVD
EUVD-2026-41078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cisco catalyst_center *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-20191 is a high-severity vulnerability in Cisco Catalyst Center that allows an unauthenticated, remote attacker to read arbitrary files from a restricted container.

This vulnerability occurs because of insufficient validation of user-supplied input. An attacker can exploit it by sending a specially crafted HTTP request to an affected device.

If successfully exploited, the attacker could gain access to sensitive files within the restricted container of the device.

Detection Guidance

There are no specific detection methods or commands provided to identify this vulnerability on your network or system.

Impact Analysis

This vulnerability can impact you by allowing an unauthenticated, remote attacker to read sensitive files from a restricted container on your Cisco Catalyst Center device.

Such unauthorized access to sensitive information could lead to data exposure and potential compromise of confidential data.

Because the attacker does not need any privileges or user interaction, the risk of exploitation is higher.

Compliance Impact

The vulnerability allows unauthenticated, remote attackers to read arbitrary files from a restricted container, potentially exposing sensitive information.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding of personal and sensitive information.

Organizations using affected Cisco Catalyst Center devices should apply the provided software updates promptly to mitigate the risk of data exposure and maintain compliance with these standards.

Mitigation Strategies

To mitigate this vulnerability, customers are strongly advised to upgrade to the fixed software releases provided by Cisco.

No workarounds are available for this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart