Security Resilience

CVE-2026-20312

Published
05 August 2026
Modified
23 October 2026
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0031 22th percentile
Risk Priority 63 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-20312 is a high-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Cisco Catalyst SD-WAN (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities…

more

tracked by CVE-2026-20312 are related to Cleartext storage of sensitive information issues that are grouped under the Common Weakness Enumeration (CWE) CWE-312.

CWE(s)
CWE-312

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1552.006 Group Policy Preferences Credential Access
Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).
attack.mitre.org →
T1555.002 Securityd Memory Credential Access
An adversary with root access may gather credentials by reading `securityd`’s memory.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-39440Shared CWE-312
CVE-2023-30530Shared CWE-312
CVE-2024-7259Shared CWE-312
CVE-2025-63208Shared CWE-312
CVE-2023-46388Shared CWE-312
CVE-2024-46340Shared CWE-312
CVE-2023-33373Shared CWE-312
CVE-2023-22949Shared CWE-312
CVE-2024-38877Shared CWE-312
CVE-2024-54127Shared CWE-312

Affected Assets

Cisco
Catalyst SD-WAN
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V14.2.8

Mitigating Controls (NIST 800-53 r5) AI

SC-28 Protection of Information at Rest good match

SC-28 requires cryptographic or equivalent protection of sensitive data at rest, directly stopping cleartext storage in accessible resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 full match
blocks

Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography full match
removes

created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).

A.8.12 Data leakage prevention partial match
finds

When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Oracle Linux 8 (1 rule)
  • V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. blocks CWE-312
Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. blocks CWE-312
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. blocks CWE-312

References