Loading story…
Cisco issued a high-severity advisory and patches for Cisco Meeting Management addressing CVE-2026-20098 (reported as CVSS 8.8), an authenticated remote arbitrary file upload flaw in the product’s Certificate Management web interface. Due to improper input validation, an attacker with valid credentials—requiring as little as the “video operator” role—can send crafted HTTP requests to upload malicious files that may overwrite system files and be processed by the root account, enabling arbitrary command execution and privilege escalation to root.
Cisco also released fixes for a separate issue in its video endpoint software: CVE-2026-20119 (reported as CVSS 7.5) affecting Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS, where a flaw in the text rendering subsystem can allow an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition on affected devices. Organizations running these collaboration platforms should prioritize applying the vendor updates, particularly where Meeting Management is exposed to users beyond tightly controlled admin groups.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco released security updates addressing CVE-2026-20098 in Cisco Meeting Management and CVE-2026-20119, an unauthenticated denial-of-service issue in Cisco TelePresence CE Software and RoomOS that can be triggered by crafted rendered text such as a meeting invitation. Fixed versions include Meeting Management 3.12.1 MR or later and specified RoomOS/firmware releases, and Cisco said there were no reports of in-the-wild exploitation.
The NATO Cyber Security Centre Penetration Testing Team reported CVE-2026-20098, a flaw in Cisco Meeting Management's Certificate Management feature that lets an authenticated low-privilege user upload arbitrary files, execute commands, and gain root privileges. The exact report date is not stated in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released emergency fixes for two **critical (CVSS 10.0)** vulnerabilities in its firewall management software that could allow **remote, unauthenticated attackers** to execute code and gain **root-level** access to the underlying operating system. The issues are tracked as `CVE-2026-20079` and `CVE-2026-20131`, and reporting emphasized the risk profile given Cisco’s widespread deployment in large enterprises and the historical interest of sophisticated actors in rapidly weaponizing Cisco bugs. Available reporting stated there were **no confirmed in-the-wild exploitation** reports at the time of publication, but urged rapid patching due to the combination of unauthenticated reachability and full compromise potential. Separate coverage packaged the Cisco flaws alongside other weekly security items (e.g., Tycoon2FA infrastructure takedown and other incidents), but the Cisco item consistently described the same two maximum-severity firewall management vulnerabilities and their impact (RCE leading to root access).
Jun 29, 2026
Cisco released fixes for **CVE-2026-20262**, an actively exploited vulnerability in **Cisco Catalyst SD-WAN Manager** (`vManage`) that allows an authenticated remote attacker with low privileges to upload or overwrite files through crafted HTTP requests and ultimately execute commands as **root**. The flaw stems from insufficient validation of user-supplied input during file uploads in the web UI and affects **all deployment models**, including on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP environments. Cisco said it became aware of in-the-wild exploitation in June and urged customers to patch immediately, warning that the product’s central role in orchestrating SD-WAN fabrics raises the operational impact of compromise. The company published indicators of compromise tied to uploaded `.jsp` and `.war` files, including filenames such as `index.jsp` and `suspicious.war`, and advised defenders to inspect `vmanage-server`, `vmanage-appserver`, and `serviceproxy-access` logs, reduce internet exposure, audit accounts, and contact TAC with an admin-tech file if intrusion is suspected.
Aug 15, 2026
Cisco released security updates for **Meeting Management**, **Secure Endpoint Connector** on Linux, macOS, and Windows, **Secure Endpoint Private Cloud**, and **BroadWorks** to remediate multiple vulnerabilities, including a critical flaw in Cisco Meeting Management tracked as `CVE-2025-20156`. The bug affects authorization validation in the REST API and allows an authenticated remote attacker to escalate privileges to administrator, potentially taking full control of managed nodes. Cisco also patched `CVE-2025-20165` in BroadWorks, where crafted SIP requests can trigger a denial of service. ClamAV separately published patch releases **1.4.2** and **1.0.8** to fix `CVE-2025-20128`, a parser flaw in OLE2 file handling that affects all currently supported versions since ClamAV 1.0.0 and was identified by **OSS-Fuzz**. Cisco said the same ClamAV issue affects Secure Endpoint products, where crafted files could disable the antivirus component, and noted that proof-of-concept exploit code is available. The ClamAV releases also address a **ClamOnAcc** stability problem that could cause an infinite loop when a watched directory does not exist.
Jul 24, 2026