CVE-2026-20191: catalyst center from 2.3.7.0 (inclusive), through 2.3.7.11 (inclusive), from 3.1.3 (inclusive), before 3.1.6-75524.200…

Affected technology

catalyst center · from 2.3.7.0 (inclusive), through 2.3.7.11 (inclusive)
cisco

catalyst center · from 3.1.3 (inclusive), before 3.1.6-75524.200 (exclusive)
cisco

catalyst center global manager · before 1.4.1 (exclusive)
cisco

Cisco Catalyst Center · 2.3.7.0-VA, 2.3.7.5-VA, 2.3.7.6-VA, 2.3.7.7-VA, 2.3.7.9-VA, 3.1.3, 3.1.3-VA, 2.3.7.10-VA, 3.1.5, 3.1.5-VA, 3.1.5-VA on AWS, 3.1.5-RevUp, 3.1.6, 3.1.6-VA, 3.1.6-BETA, 3.1.6-GSMU100, 3.1.6-VA-GSMU100
Cisco

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated, remote attacker could read arbitrary files from a restricted container. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.