CVE-2026-20191: Cisco Catalyst Center Path Traversal

CVE-2026-20191 Overview

CVE-2026-20191 is a path traversal vulnerability in Cisco Catalyst Center that allows an unauthenticated, remote attacker to read arbitrary files from a restricted container. The flaw stems from insufficient validation of user-supplied input in an HTTP request handler. An attacker can send a crafted HTTP request to an affected device and retrieve files that should remain isolated within the container boundary. The weakness is tracked as [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can read arbitrary files from a restricted container on affected Cisco Catalyst Center appliances, exposing sensitive configuration data and secrets.

Affected Products

Cisco Catalyst Center (formerly Cisco DNA Center)

Discovery Timeline

2026-07-01 - CVE-2026-20191 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-20191

Vulnerability Analysis

The vulnerability resides in an HTTP request handler exposed by Cisco Catalyst Center. The handler accepts user-supplied input that is used to construct a file path inside a restricted container. Because the input is not properly validated or canonicalized, an attacker can supply traversal sequences that escape the intended directory.

A successful request causes the application to return the contents of files that were meant to be inaccessible from the network. The confidentiality impact is high, while integrity and availability are not affected. Exploitation requires no authentication, no user interaction, and low attack complexity across the network.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The application concatenates or resolves attacker-controlled input into a filesystem path without rejecting .. sequences, absolute paths, or encoded traversal payloads. This design flaw allows the request handler to resolve paths outside the intended container subtree.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request containing traversal payloads in a vulnerable parameter to an internet-reachable or network-reachable Catalyst Center instance. The server processes the path, opens the target file, and returns its contents in the HTTP response. No credentials or prior access are required.

No public proof-of-concept exploit and no verified code examples are available at the time of publication. Refer to the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-20191

Indicators of Compromise

HTTP requests to Catalyst Center endpoints containing traversal sequences such as ../, ..%2f, or %2e%2e%2f in path or query parameters.
Web server or application logs showing successful 200 OK responses to requests referencing sensitive filesystem paths (for example /etc/passwd, application config files, or credential stores).
Unusual outbound response payload sizes from Catalyst Center management interfaces following requests from untrusted sources.

Detection Strategies

Inspect Catalyst Center HTTP access logs for URI patterns containing encoded or decoded directory traversal tokens.
Deploy web application firewall (WAF) or intrusion detection signatures that flag traversal attempts against Catalyst Center hostnames and management VIPs.
Correlate anomalous file-read patterns with source IP reputation and geolocation to prioritize investigation.

Monitoring Recommendations

Continuously monitor administrative interfaces of Catalyst Center for unauthenticated HTTP access from non-management network segments.
Alert on repeated 4xx or 5xx anomalies followed by successful 2xx responses to the same endpoint, which may indicate exploit tuning.
Forward Catalyst Center logs to a central SIEM or data lake to enable retrospective hunting across historical traffic.

How to Mitigate CVE-2026-20191

Immediate Actions Required

Apply the fixed software release identified in the Cisco Security Advisory as soon as maintenance windows allow.
Restrict network access to Catalyst Center management interfaces to trusted administrative subnets only.
Audit Catalyst Center HTTP logs for prior exploitation attempts and rotate any credentials or secrets stored on the appliance if compromise is suspected.

Patch Information

Cisco has published a security advisory for CVE-2026-20191. Administrators should consult the Cisco Security Advisory for the list of fixed releases and upgrade guidance specific to their deployed Catalyst Center version.

Workarounds

Place Catalyst Center behind a reverse proxy or WAF that blocks HTTP requests containing directory traversal sequences.
Enforce network segmentation and access control lists so that only authorized management hosts can reach the Catalyst Center HTTPS interface.
Disable or block external access to the affected endpoints until the patched release is deployed.

bash

# Example ACL restricting Catalyst Center management access to a trusted subnet
ip access-list extended CATC-MGMT-ACCESS
 permit tcp 10.10.0.0 0.0.255.255 host <catalyst-center-ip> eq 443
 deny   tcp any host <catalyst-center-ip> eq 443 log
 permit ip any any