Loading story…
Cisco released security advisories for Cisco RoomOS covering multiple deployment modes and release trains, including Release 11 and Release 26 in both On-Premises Operation and Cloud-Aware Operation configurations. The updates address high-severity vulnerabilities including CVE-2026-20150, an improper access control issue rated CVSS 8.8, and CVE-2026-20156, a memory buffer management flaw rated CVSS 8.1; both are described as remotely exploitable and capable of affecting confidentiality, integrity, and availability.
Affected software spans numerous RoomOS 10.x, 11.x, and 26.x versions, with fixed-version thresholds identified as 11.32.6.0, RoomOS 11.39.1.1, 26.5.2.2, and RoomOS June 2026 (26.7.1.7) depending on deployment model. The Canadian Centre for Cyber Security urged administrators to review Cisco’s advisories and apply the latest vendor patches and security releases to vulnerable RoomOS systems.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On July 15, 2026, the Canadian Centre for Cyber Security published alert AV26-706 summarizing Cisco's RoomOS advisories. The notice urged users and administrators to review Cisco's advisory links and apply the necessary updates.
On July 15, 2026, Cisco published security advisories for Cisco RoomOS covering multiple vulnerabilities, including CVE-2026-20150 and CVE-2026-20156. The advisories identified affected Release 11 and Release 26 deployment modes and provided fixed-version thresholds such as 11.32.6.0, 11.39.1.1, 26.5.2.2, and 26.7.1.7.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for multiple product lines, fixing 15 vulnerabilities across **Catalyst SD-WAN Software**, **IOS XE Software**, **IOS Software**, and **Integrated Management Controller**, with additional advisories covering **RoomOS**, **Secure Firewall Management Center**, and **Terminal Services Agent**. The most severe issues include several critical flaws in Catalyst SD-WAN, including `CVE-2026-20303` through `CVE-2026-20313`, and critical vulnerabilities in IOS XE that could allow **authentication bypass**, **command injection**, **privilege escalation**, and unauthorized access to restricted functions on enterprise routers, switches, and WAN infrastructure. Cisco said the vulnerabilities could enable attackers to disrupt WAN environments, execute commands, and in some cases compromise broader network environments, while a separate high-severity issue in Integrated Management Controller could lead to root compromise and Secure Firewall Management Center was found to contain a static-credential weakness. Cisco published patched software versions and, according to reporting and CERT guidance, organizations were urged to review the advisories and deploy the August security updates promptly; Cisco said it had no indication of active exploitation at the time of disclosure.
Aug 11, 2026
Cisco released emergency fixes for two **critical (CVSS 10.0)** vulnerabilities in its firewall management software that could allow **remote, unauthenticated attackers** to execute code and gain **root-level** access to the underlying operating system. The issues are tracked as `CVE-2026-20079` and `CVE-2026-20131`, and reporting emphasized the risk profile given Cisco’s widespread deployment in large enterprises and the historical interest of sophisticated actors in rapidly weaponizing Cisco bugs. Available reporting stated there were **no confirmed in-the-wild exploitation** reports at the time of publication, but urged rapid patching due to the combination of unauthenticated reachability and full compromise potential. Separate coverage packaged the Cisco flaws alongside other weekly security items (e.g., Tycoon2FA infrastructure takedown and other incidents), but the Cisco item consistently described the same two maximum-severity firewall management vulnerabilities and their impact (RCE leading to root access).
Jun 29, 2026
Cisco has released security updates to address multiple high-severity vulnerabilities affecting its Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, IP Phone 8821, and Video Phone 8875 products. The most notable flaw, tracked as CVE-2025-20350, is a denial-of-service (DoS) vulnerability that could allow remote attackers to disrupt the normal operation of affected devices. According to Cisco's advisories, the vulnerabilities impact devices running versions prior to 3.3(1) for the Desk Phone 9800 Series, prior to 14.4(1) for the IP Phone 7800 and 8800 Series, prior to 11.0(6)SR7 for the IP Phone 8821, and prior to 3.3(1) for the Video Phone 8875. The Canadian Centre for Cyber Security (CCCS) has also issued an alert, urging organizations to review Cisco's advisories and apply the recommended patches and mitigations without delay. The vulnerabilities include both denial-of-service and information disclosure issues, with some flaws related to SIP software and others affecting the underlying RoomOS and TelePresence Collaboration Endpoint software. Cisco's advisories detail that exploitation of these vulnerabilities could result in service interruptions, potentially impacting business communications and operations. The company has provided specific version updates to remediate the risks, and administrators are advised to upgrade to the latest secure releases. The advisories also mention vulnerabilities in Cisco's Snort 3 software, but the primary focus is on the telephony products. No active exploitation of these vulnerabilities has been reported at the time of the advisories, but the critical nature of the flaws warrants immediate attention. The updates are part of Cisco's ongoing efforts to address security weaknesses in its widely deployed communication devices. Organizations using affected Cisco phone models should prioritize patching to prevent potential denial-of-service attacks that could disrupt voice and video communications. The CCCS highlights the importance of following Cisco's mitigation guidance to ensure continued secure operation of telephony infrastructure. Cisco's prompt response and detailed advisories provide clear remediation steps for network administrators. The vulnerabilities underscore the need for regular patch management and vigilance in monitoring vendor security updates. Failure to address these issues could expose organizations to service outages and potential information leaks. The advisories serve as a reminder of the critical role that secure communication endpoints play in enterprise environments. By applying the recommended patches, organizations can mitigate the risk of disruption and maintain the integrity of their communication systems.
Jun 29, 2026