Loading story…
Cisco has disclosed a high-severity privilege escalation vulnerability, tracked as CVE-2025-20341, affecting the Cisco Catalyst Center Virtual Appliance. The flaw allows an authenticated, remote attacker with at least Observer-level credentials to elevate privileges to Administrator by submitting a crafted HTTP request due to insufficient validation of user-supplied input. Successful exploitation could enable unauthorized modifications, including creating new user accounts or elevating existing privileges, posing a significant risk to affected systems.
Security advisories from both Cisco and the Canadian Centre for Cyber Security urge administrators to review the official guidance and apply updates or mitigations to address the vulnerability. The issue impacts Catalyst Center Virtual Appliance versions prior to 2.3.7.10-VA and is remotely exploitable. Organizations using affected versions are strongly advised to update their systems promptly to prevent potential exploitation.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Cisco published a security advisory for a Cisco Catalyst Center Arbitrary File Read Vulnerability. The advisory represents a new vulnerability disclosure affecting Cisco Catalyst Center, distinct from the previously tracked CVE-2025-20341 privilege escalation issue.
The Canadian Centre for Cyber Security published alert AV25-759 referencing Cisco's security advisory for CVE-2025-20341. This reflects official downstream government notice of the vulnerability.
Cisco disclosed a high-severity privilege escalation vulnerability, tracked as CVE-2025-20341, affecting Cisco Catalyst Center Virtual Appliance. The issue was publicly listed in vulnerability and advisory reporting on November 13, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
sec.cloudapps.cisco.com
Open sourcesecurityonline.info
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates to address **CVE-2026-20245**, an authenticated local privilege escalation vulnerability in **Cisco Catalyst SD-WAN Manager**. The flaw stems from insufficient validation of user-supplied input during file upload, allowing a low-privileged local attacker to upload a crafted file, execute arbitrary commands, and escalate privileges to **root** on affected systems. The vulnerability carries a **CVSS score of 7.8** and requires low privileges, low attack complexity, and no user interaction. Security notices published in June urged organizations using affected SD-WAN Manager deployments to test and deploy Cisco's fixes as soon as possible to reduce the risk of post-authentication compromise of network management infrastructure.
Jul 8, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco disclosed **CVE-2026-20223**, a critical `CVSS 10.0` vulnerability in Cisco Secure Workload Cluster Software that allows an unauthenticated remote attacker to gain **Site Admin** privileges by sending crafted requests to internal REST API endpoints. The flaw stems from insufficient authentication and access validation (`CWE-306`) and affects both **SaaS** and **on-premises** deployments, enabling access to site resources, exposure of sensitive information, and configuration changes that can cross tenant boundaries. Cisco said its hosted SaaS environments have already been remediated, while customers running affected versions must upgrade because **no workaround is available**. Fixed releases include **3.10.8.3** and **4.0.3.17**, with the issue affecting version **3.9 and earlier**, versions before **3.10.8.3**, and versions before **4.0.3.17**. Cisco and the Canadian Centre for Cyber Security urged administrators to review the advisory and apply updates promptly; Cisco said it is not aware of active exploitation and reported that the vulnerability was identified during internal security testing.
Jul 23, 2026