The vulnerability identified as CVE-2026-20191 affects Cisco Catalyst Center and involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. This allows an unauthenticated remote attacker to exploit insufficient input validation by sending a crafted HTTP request, enabling unauthorized reading of arbitrary files within a restricted container on the affected device. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to network attack vector, no required privileges or user interaction, and high confidentiality impact without affecting integrity or availability. The affected versions include multiple specific releases of Cisco Catalyst Center, but no official patch or remediation level has been disclosed as of the published date.

An attacker can remotely and without authentication read arbitrary files from a restricted container on the affected Cisco Catalyst Center device. This compromises confidentiality of potentially sensitive information stored within the device. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Cisco Catalyst Center management interface to trusted users only and monitor for suspicious HTTP requests targeting path traversal attempts.