Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-20114 (GCVE-0-2026-20114)
Vulnerability from cvelistv5 – Published: 2026-03-25 16:08 – Updated: 2026-03-25 17:34
VLAI?
EPSS
Summary
A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.
This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
Severity ?
5.4 (Medium)
CWE
- CWE-1286 - Improper Validation of Syntactic Correctness of Input
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco IOS XE Software |
Affected:
16.11.1
Affected: 16.11.1a Affected: 16.11.1b Affected: 16.11.2 Affected: 16.11.1s Affected: 16.12.1 Affected: 16.12.1s Affected: 16.12.1a Affected: 16.12.1c Affected: 16.12.1w Affected: 16.12.2 Affected: 16.12.1y Affected: 16.12.2a Affected: 16.12.3 Affected: 16.12.8 Affected: 16.12.2s Affected: 16.12.1x Affected: 16.12.1t Affected: 16.12.4 Affected: 16.12.3s Affected: 16.12.3a Affected: 16.12.4a Affected: 16.12.5 Affected: 16.12.6 Affected: 16.12.1z1 Affected: 16.12.5a Affected: 16.12.5b Affected: 16.12.1z2 Affected: 16.12.6a Affected: 16.12.7 Affected: 16.12.9 Affected: 16.12.10 Affected: 16.12.10a Affected: 16.12.11 Affected: 16.12.12 Affected: 16.12.13 Affected: 16.12.14 Affected: 17.1.1 Affected: 17.1.1a Affected: 17.1.1s Affected: 17.1.1t Affected: 17.1.3 Affected: 17.2.1 Affected: 17.2.1r Affected: 17.2.1a Affected: 17.2.1v Affected: 17.2.2 Affected: 17.2.3 Affected: 17.3.1 Affected: 17.3.2 Affected: 17.3.3 Affected: 17.3.1a Affected: 17.3.1w Affected: 17.3.2a Affected: 17.3.1x Affected: 17.3.1z Affected: 17.3.4 Affected: 17.3.5 Affected: 17.3.4a Affected: 17.3.6 Affected: 17.3.4b Affected: 17.3.4c Affected: 17.3.5a Affected: 17.3.5b Affected: 17.3.7 Affected: 17.3.8 Affected: 17.3.8a Affected: 17.4.1 Affected: 17.4.2 Affected: 17.4.1a Affected: 17.4.1b Affected: 17.4.2a Affected: 17.5.1 Affected: 17.5.1a Affected: 17.6.1 Affected: 17.6.2 Affected: 17.6.1w Affected: 17.6.1a Affected: 17.6.1x Affected: 17.6.3 Affected: 17.6.1y Affected: 17.6.1z Affected: 17.6.3a Affected: 17.6.4 Affected: 17.6.1z1 Affected: 17.6.5 Affected: 17.6.6 Affected: 17.6.6a Affected: 17.6.5a Affected: 17.6.7 Affected: 17.6.8 Affected: 17.6.8a Affected: 17.7.1 Affected: 17.7.1a Affected: 17.7.1b Affected: 17.7.2 Affected: 17.10.1 Affected: 17.10.1a Affected: 17.10.1b Affected: 17.8.1 Affected: 17.8.1a Affected: 17.9.1 Affected: 17.9.1w Affected: 17.9.2 Affected: 17.9.1a Affected: 17.9.1x Affected: 17.9.1y Affected: 17.9.3 Affected: 17.9.2a Affected: 17.9.1x1 Affected: 17.9.3a Affected: 17.9.4 Affected: 17.9.1y1 Affected: 17.9.5 Affected: 17.9.4a Affected: 17.9.5a Affected: 17.9.5b Affected: 17.9.6 Affected: 17.9.6a Affected: 17.9.7 Affected: 17.9.5e Affected: 17.9.5f Affected: 17.9.8 Affected: 17.9.7a Affected: 17.9.7b Affected: 17.11.1 Affected: 17.11.1a Affected: 17.12.1 Affected: 17.12.1w Affected: 17.12.1a Affected: 17.12.1x Affected: 17.12.2 Affected: 17.12.3 Affected: 17.12.2a Affected: 17.12.1y Affected: 17.12.1z Affected: 17.12.4 Affected: 17.12.3a Affected: 17.12.1z1 Affected: 17.12.1z2 Affected: 17.12.4a Affected: 17.12.5 Affected: 17.12.4b Affected: 17.12.1z3 Affected: 17.12.5a Affected: 17.12.1z4 Affected: 17.12.5b Affected: 17.12.5c Affected: 17.12.5d Affected: 17.13.1 Affected: 17.13.1a Affected: 17.14.1 Affected: 17.14.1a Affected: 17.15.1 Affected: 17.15.1w Affected: 17.15.1a Affected: 17.15.2 Affected: 17.15.1b Affected: 17.15.1x Affected: 17.15.1z Affected: 17.15.3 Affected: 17.15.2c Affected: 17.15.2a Affected: 17.15.1y Affected: 17.15.2b Affected: 17.15.3a Affected: 17.15.4 Affected: 17.15.3b Affected: 17.15.4d Affected: 17.15.4e Affected: 17.16.1 Affected: 17.16.1a Affected: 17.17.1 Affected: 17.18.1 Affected: 17.18.1w Affected: 17.18.1a |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T17:33:47.412777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T17:34:18.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco IOS XE Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "16.11.1"
},
{
"status": "affected",
"version": "16.11.1a"
},
{
"status": "affected",
"version": "16.11.1b"
},
{
"status": "affected",
"version": "16.11.2"
},
{
"status": "affected",
"version": "16.11.1s"
},
{
"status": "affected",
"version": "16.12.1"
},
{
"status": "affected",
"version": "16.12.1s"
},
{
"status": "affected",
"version": "16.12.1a"
},
{
"status": "affected",
"version": "16.12.1c"
},
{
"status": "affected",
"version": "16.12.1w"
},
{
"status": "affected",
"version": "16.12.2"
},
{
"status": "affected",
"version": "16.12.1y"
},
{
"status": "affected",
"version": "16.12.2a"
},
{
"status": "affected",
"version": "16.12.3"
},
{
"status": "affected",
"version": "16.12.8"
},
{
"status": "affected",
"version": "16.12.2s"
},
{
"status": "affected",
"version": "16.12.1x"
},
{
"status": "affected",
"version": "16.12.1t"
},
{
"status": "affected",
"version": "16.12.4"
},
{
"status": "affected",
"version": "16.12.3s"
},
{
"status": "affected",
"version": "16.12.3a"
},
{
"status": "affected",
"version": "16.12.4a"
},
{
"status": "affected",
"version": "16.12.5"
},
{
"status": "affected",
"version": "16.12.6"
},
{
"status": "affected",
"version": "16.12.1z1"
},
{
"status": "affected",
"version": "16.12.5a"
},
{
"status": "affected",
"version": "16.12.5b"
},
{
"status": "affected",
"version": "16.12.1z2"
},
{
"status": "affected",
"version": "16.12.6a"
},
{
"status": "affected",
"version": "16.12.7"
},
{
"status": "affected",
"version": "16.12.9"
},
{
"status": "affected",
"version": "16.12.10"
},
{
"status": "affected",
"version": "16.12.10a"
},
{
"status": "affected",
"version": "16.12.11"
},
{
"status": "affected",
"version": "16.12.12"
},
{
"status": "affected",
"version": "16.12.13"
},
{
"status": "affected",
"version": "16.12.14"
},
{
"status": "affected",
"version": "17.1.1"
},
{
"status": "affected",
"version": "17.1.1a"
},
{
"status": "affected",
"version": "17.1.1s"
},
{
"status": "affected",
"version": "17.1.1t"
},
{
"status": "affected",
"version": "17.1.3"
},
{
"status": "affected",
"version": "17.2.1"
},
{
"status": "affected",
"version": "17.2.1r"
},
{
"status": "affected",
"version": "17.2.1a"
},
{
"status": "affected",
"version": "17.2.1v"
},
{
"status": "affected",
"version": "17.2.2"
},
{
"status": "affected",
"version": "17.2.3"
},
{
"status": "affected",
"version": "17.3.1"
},
{
"status": "affected",
"version": "17.3.2"
},
{
"status": "affected",
"version": "17.3.3"
},
{
"status": "affected",
"version": "17.3.1a"
},
{
"status": "affected",
"version": "17.3.1w"
},
{
"status": "affected",
"version": "17.3.2a"
},
{
"status": "affected",
"version": "17.3.1x"
},
{
"status": "affected",
"version": "17.3.1z"
},
{
"status": "affected",
"version": "17.3.4"
},
{
"status": "affected",
"version": "17.3.5"
},
{
"status": "affected",
"version": "17.3.4a"
},
{
"status": "affected",
"version": "17.3.6"
},
{
"status": "affected",
"version": "17.3.4b"
},
{
"status": "affected",
"version": "17.3.4c"
},
{
"status": "affected",
"version": "17.3.5a"
},
{
"status": "affected",
"version": "17.3.5b"
},
{
"status": "affected",
"version": "17.3.7"
},
{
"status": "affected",
"version": "17.3.8"
},
{
"status": "affected",
"version": "17.3.8a"
},
{
"status": "affected",
"version": "17.4.1"
},
{
"status": "affected",
"version": "17.4.2"
},
{
"status": "affected",
"version": "17.4.1a"
},
{
"status": "affected",
"version": "17.4.1b"
},
{
"status": "affected",
"version": "17.4.2a"
},
{
"status": "affected",
"version": "17.5.1"
},
{
"status": "affected",
"version": "17.5.1a"
},
{
"status": "affected",
"version": "17.6.1"
},
{
"status": "affected",
"version": "17.6.2"
},
{
"status": "affected",
"version": "17.6.1w"
},
{
"status": "affected",
"version": "17.6.1a"
},
{
"status": "affected",
"version": "17.6.1x"
},
{
"status": "affected",
"version": "17.6.3"
},
{
"status": "affected",
"version": "17.6.1y"
},
{
"status": "affected",
"version": "17.6.1z"
},
{
"status": "affected",
"version": "17.6.3a"
},
{
"status": "affected",
"version": "17.6.4"
},
{
"status": "affected",
"version": "17.6.1z1"
},
{
"status": "affected",
"version": "17.6.5"
},
{
"status": "affected",
"version": "17.6.6"
},
{
"status": "affected",
"version": "17.6.6a"
},
{
"status": "affected",
"version": "17.6.5a"
},
{
"status": "affected",
"version": "17.6.7"
},
{
"status": "affected",
"version": "17.6.8"
},
{
"status": "affected",
"version": "17.6.8a"
},
{
"status": "affected",
"version": "17.7.1"
},
{
"status": "affected",
"version": "17.7.1a"
},
{
"status": "affected",
"version": "17.7.1b"
},
{
"status": "affected",
"version": "17.7.2"
},
{
"status": "affected",
"version": "17.10.1"
},
{
"status": "affected",
"version": "17.10.1a"
},
{
"status": "affected",
"version": "17.10.1b"
},
{
"status": "affected",
"version": "17.8.1"
},
{
"status": "affected",
"version": "17.8.1a"
},
{
"status": "affected",
"version": "17.9.1"
},
{
"status": "affected",
"version": "17.9.1w"
},
{
"status": "affected",
"version": "17.9.2"
},
{
"status": "affected",
"version": "17.9.1a"
},
{
"status": "affected",
"version": "17.9.1x"
},
{
"status": "affected",
"version": "17.9.1y"
},
{
"status": "affected",
"version": "17.9.3"
},
{
"status": "affected",
"version": "17.9.2a"
},
{
"status": "affected",
"version": "17.9.1x1"
},
{
"status": "affected",
"version": "17.9.3a"
},
{
"status": "affected",
"version": "17.9.4"
},
{
"status": "affected",
"version": "17.9.1y1"
},
{
"status": "affected",
"version": "17.9.5"
},
{
"status": "affected",
"version": "17.9.4a"
},
{
"status": "affected",
"version": "17.9.5a"
},
{
"status": "affected",
"version": "17.9.5b"
},
{
"status": "affected",
"version": "17.9.6"
},
{
"status": "affected",
"version": "17.9.6a"
},
{
"status": "affected",
"version": "17.9.7"
},
{
"status": "affected",
"version": "17.9.5e"
},
{
"status": "affected",
"version": "17.9.5f"
},
{
"status": "affected",
"version": "17.9.8"
},
{
"status": "affected",
"version": "17.9.7a"
},
{
"status": "affected",
"version": "17.9.7b"
},
{
"status": "affected",
"version": "17.11.1"
},
{
"status": "affected",
"version": "17.11.1a"
},
{
"status": "affected",
"version": "17.12.1"
},
{
"status": "affected",
"version": "17.12.1w"
},
{
"status": "affected",
"version": "17.12.1a"
},
{
"status": "affected",
"version": "17.12.1x"
},
{
"status": "affected",
"version": "17.12.2"
},
{
"status": "affected",
"version": "17.12.3"
},
{
"status": "affected",
"version": "17.12.2a"
},
{
"status": "affected",
"version": "17.12.1y"
},
{
"status": "affected",
"version": "17.12.1z"
},
{
"status": "affected",
"version": "17.12.4"
},
{
"status": "affected",
"version": "17.12.3a"
},
{
"status": "affected",
"version": "17.12.1z1"
},
{
"status": "affected",
"version": "17.12.1z2"
},
{
"status": "affected",
"version": "17.12.4a"
},
{
"status": "affected",
"version": "17.12.5"
},
{
"status": "affected",
"version": "17.12.4b"
},
{
"status": "affected",
"version": "17.12.1z3"
},
{
"status": "affected",
"version": "17.12.5a"
},
{
"status": "affected",
"version": "17.12.1z4"
},
{
"status": "affected",
"version": "17.12.5b"
},
{
"status": "affected",
"version": "17.12.5c"
},
{
"status": "affected",
"version": "17.12.5d"
},
{
"status": "affected",
"version": "17.13.1"
},
{
"status": "affected",
"version": "17.13.1a"
},
{
"status": "affected",
"version": "17.14.1"
},
{
"status": "affected",
"version": "17.14.1a"
},
{
"status": "affected",
"version": "17.15.1"
},
{
"status": "affected",
"version": "17.15.1w"
},
{
"status": "affected",
"version": "17.15.1a"
},
{
"status": "affected",
"version": "17.15.2"
},
{
"status": "affected",
"version": "17.15.1b"
},
{
"status": "affected",
"version": "17.15.1x"
},
{
"status": "affected",
"version": "17.15.1z"
},
{
"status": "affected",
"version": "17.15.3"
},
{
"status": "affected",
"version": "17.15.2c"
},
{
"status": "affected",
"version": "17.15.2a"
},
{
"status": "affected",
"version": "17.15.1y"
},
{
"status": "affected",
"version": "17.15.2b"
},
{
"status": "affected",
"version": "17.15.3a"
},
{
"status": "affected",
"version": "17.15.4"
},
{
"status": "affected",
"version": "17.15.3b"
},
{
"status": "affected",
"version": "17.15.4d"
},
{
"status": "affected",
"version": "17.15.4e"
},
{
"status": "affected",
"version": "17.16.1"
},
{
"status": "affected",
"version": "17.16.1a"
},
{
"status": "affected",
"version": "17.17.1"
},
{
"status": "affected",
"version": "17.18.1"
},
{
"status": "affected",
"version": "17.18.1w"
},
{
"status": "affected",
"version": "17.18.1a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. \r\n\r This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is aware that a public announcement is available for the vulnerability that is described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1286",
"description": "Improper Validation of Syntactic Correctness of Input",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T16:08:17.586Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-iosxe-lobby-privesc-KwxBqJy",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
}
],
"source": {
"advisory": "cisco-sa-iosxe-lobby-privesc-KwxBqJy",
"defects": [
"CSCwq16757"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20114",
"datePublished": "2026-03-25T16:08:17.586Z",
"dateReserved": "2025-10-08T11:59:15.375Z",
"dateUpdated": "2026-03-25T17:34:18.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-20114",
"date": "2026-05-18",
"epss": "0.00036",
"percentile": "0.10669"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-20114\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2026-03-25T16:16:16.117\",\"lastModified\":\"2026-03-26T15:13:15.790\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. \\r\\n\\r This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1286\"}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy\",\"source\":\"psirt@cisco.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-20114\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-25T17:33:47.412777Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-25T17:34:11.879Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwq16757\"], \"advisory\": \"cisco-sa-iosxe-lobby-privesc-KwxBqJy\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco IOS XE Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"16.11.1\"}, {\"status\": \"affected\", \"version\": \"16.11.1a\"}, {\"status\": \"affected\", \"version\": \"16.11.1b\"}, {\"status\": \"affected\", \"version\": \"16.11.2\"}, {\"status\": \"affected\", \"version\": \"16.11.1s\"}, {\"status\": \"affected\", \"version\": \"16.12.1\"}, {\"status\": \"affected\", \"version\": \"16.12.1s\"}, {\"status\": \"affected\", \"version\": \"16.12.1a\"}, {\"status\": \"affected\", \"version\": \"16.12.1c\"}, {\"status\": \"affected\", \"version\": \"16.12.1w\"}, {\"status\": \"affected\", \"version\": \"16.12.2\"}, {\"status\": \"affected\", \"version\": \"16.12.1y\"}, {\"status\": \"affected\", \"version\": \"16.12.2a\"}, {\"status\": \"affected\", \"version\": \"16.12.3\"}, {\"status\": \"affected\", \"version\": \"16.12.8\"}, {\"status\": \"affected\", \"version\": \"16.12.2s\"}, {\"status\": \"affected\", \"version\": \"16.12.1x\"}, {\"status\": \"affected\", \"version\": \"16.12.1t\"}, {\"status\": \"affected\", \"version\": \"16.12.4\"}, {\"status\": \"affected\", \"version\": \"16.12.3s\"}, {\"status\": \"affected\", \"version\": \"16.12.3a\"}, {\"status\": \"affected\", \"version\": \"16.12.4a\"}, {\"status\": \"affected\", \"version\": \"16.12.5\"}, {\"status\": \"affected\", \"version\": \"16.12.6\"}, {\"status\": \"affected\", \"version\": \"16.12.1z1\"}, {\"status\": \"affected\", \"version\": \"16.12.5a\"}, {\"status\": \"affected\", \"version\": \"16.12.5b\"}, {\"status\": \"affected\", \"version\": \"16.12.1z2\"}, {\"status\": \"affected\", \"version\": \"16.12.6a\"}, {\"status\": \"affected\", \"version\": \"16.12.7\"}, {\"status\": \"affected\", \"version\": \"16.12.9\"}, {\"status\": \"affected\", \"version\": \"16.12.10\"}, {\"status\": \"affected\", \"version\": \"16.12.10a\"}, {\"status\": \"affected\", \"version\": \"16.12.11\"}, {\"status\": \"affected\", \"version\": \"16.12.12\"}, {\"status\": \"affected\", \"version\": \"16.12.13\"}, {\"status\": \"affected\", \"version\": \"16.12.14\"}, {\"status\": \"affected\", \"version\": \"17.1.1\"}, {\"status\": \"affected\", \"version\": \"17.1.1a\"}, {\"status\": \"affected\", \"version\": \"17.1.1s\"}, {\"status\": \"affected\", \"version\": \"17.1.1t\"}, {\"status\": \"affected\", \"version\": \"17.1.3\"}, {\"status\": \"affected\", \"version\": \"17.2.1\"}, {\"status\": \"affected\", \"version\": \"17.2.1r\"}, {\"status\": \"affected\", \"version\": \"17.2.1a\"}, {\"status\": \"affected\", \"version\": \"17.2.1v\"}, {\"status\": \"affected\", \"version\": \"17.2.2\"}, {\"status\": \"affected\", \"version\": \"17.2.3\"}, {\"status\": \"affected\", \"version\": \"17.3.1\"}, {\"status\": \"affected\", \"version\": \"17.3.2\"}, {\"status\": \"affected\", \"version\": \"17.3.3\"}, {\"status\": \"affected\", \"version\": \"17.3.1a\"}, {\"status\": \"affected\", \"version\": \"17.3.1w\"}, {\"status\": \"affected\", \"version\": \"17.3.2a\"}, {\"status\": \"affected\", \"version\": \"17.3.1x\"}, {\"status\": \"affected\", \"version\": \"17.3.1z\"}, {\"status\": \"affected\", \"version\": \"17.3.4\"}, {\"status\": \"affected\", \"version\": \"17.3.5\"}, {\"status\": \"affected\", \"version\": \"17.3.4a\"}, {\"status\": \"affected\", \"version\": \"17.3.6\"}, {\"status\": \"affected\", \"version\": \"17.3.4b\"}, {\"status\": \"affected\", \"version\": \"17.3.4c\"}, {\"status\": \"affected\", \"version\": \"17.3.5a\"}, {\"status\": \"affected\", \"version\": \"17.3.5b\"}, {\"status\": \"affected\", \"version\": \"17.3.7\"}, {\"status\": \"affected\", \"version\": \"17.3.8\"}, {\"status\": \"affected\", \"version\": \"17.3.8a\"}, {\"status\": \"affected\", \"version\": \"17.4.1\"}, {\"status\": \"affected\", \"version\": \"17.4.2\"}, {\"status\": \"affected\", \"version\": \"17.4.1a\"}, {\"status\": \"affected\", \"version\": \"17.4.1b\"}, {\"status\": \"affected\", \"version\": \"17.4.2a\"}, {\"status\": \"affected\", \"version\": \"17.5.1\"}, {\"status\": \"affected\", \"version\": \"17.5.1a\"}, {\"status\": \"affected\", \"version\": \"17.6.1\"}, {\"status\": \"affected\", \"version\": \"17.6.2\"}, {\"status\": \"affected\", \"version\": \"17.6.1w\"}, {\"status\": \"affected\", \"version\": \"17.6.1a\"}, {\"status\": \"affected\", \"version\": \"17.6.1x\"}, {\"status\": \"affected\", \"version\": \"17.6.3\"}, {\"status\": \"affected\", \"version\": \"17.6.1y\"}, {\"status\": \"affected\", \"version\": \"17.6.1z\"}, {\"status\": \"affected\", \"version\": \"17.6.3a\"}, {\"status\": \"affected\", \"version\": \"17.6.4\"}, {\"status\": \"affected\", \"version\": \"17.6.1z1\"}, {\"status\": \"affected\", \"version\": \"17.6.5\"}, {\"status\": \"affected\", \"version\": \"17.6.6\"}, {\"status\": \"affected\", \"version\": \"17.6.6a\"}, {\"status\": \"affected\", \"version\": \"17.6.5a\"}, {\"status\": \"affected\", \"version\": \"17.6.7\"}, {\"status\": \"affected\", \"version\": \"17.6.8\"}, {\"status\": \"affected\", \"version\": \"17.6.8a\"}, {\"status\": \"affected\", \"version\": \"17.7.1\"}, {\"status\": \"affected\", \"version\": \"17.7.1a\"}, {\"status\": \"affected\", \"version\": \"17.7.1b\"}, {\"status\": \"affected\", \"version\": \"17.7.2\"}, {\"status\": \"affected\", \"version\": \"17.10.1\"}, {\"status\": \"affected\", \"version\": \"17.10.1a\"}, {\"status\": \"affected\", \"version\": \"17.10.1b\"}, {\"status\": \"affected\", \"version\": \"17.8.1\"}, {\"status\": \"affected\", \"version\": \"17.8.1a\"}, {\"status\": \"affected\", \"version\": \"17.9.1\"}, {\"status\": \"affected\", \"version\": \"17.9.1w\"}, {\"status\": \"affected\", \"version\": \"17.9.2\"}, {\"status\": \"affected\", \"version\": \"17.9.1a\"}, {\"status\": \"affected\", \"version\": \"17.9.1x\"}, {\"status\": \"affected\", \"version\": \"17.9.1y\"}, {\"status\": \"affected\", \"version\": \"17.9.3\"}, {\"status\": \"affected\", \"version\": \"17.9.2a\"}, {\"status\": \"affected\", \"version\": \"17.9.1x1\"}, {\"status\": \"affected\", \"version\": \"17.9.3a\"}, {\"status\": \"affected\", \"version\": \"17.9.4\"}, {\"status\": \"affected\", \"version\": \"17.9.1y1\"}, {\"status\": \"affected\", \"version\": \"17.9.5\"}, {\"status\": \"affected\", \"version\": \"17.9.4a\"}, {\"status\": \"affected\", \"version\": \"17.9.5a\"}, {\"status\": \"affected\", \"version\": \"17.9.5b\"}, {\"status\": \"affected\", \"version\": \"17.9.6\"}, {\"status\": \"affected\", \"version\": \"17.9.6a\"}, {\"status\": \"affected\", \"version\": \"17.9.7\"}, {\"status\": \"affected\", \"version\": \"17.9.5e\"}, {\"status\": \"affected\", \"version\": \"17.9.5f\"}, {\"status\": \"affected\", \"version\": \"17.9.8\"}, {\"status\": \"affected\", \"version\": \"17.9.7a\"}, {\"status\": \"affected\", \"version\": \"17.9.7b\"}, {\"status\": \"affected\", \"version\": \"17.11.1\"}, {\"status\": \"affected\", \"version\": \"17.11.1a\"}, {\"status\": \"affected\", \"version\": \"17.12.1\"}, {\"status\": \"affected\", \"version\": \"17.12.1w\"}, {\"status\": \"affected\", \"version\": \"17.12.1a\"}, {\"status\": \"affected\", \"version\": \"17.12.1x\"}, {\"status\": \"affected\", \"version\": \"17.12.2\"}, {\"status\": \"affected\", \"version\": \"17.12.3\"}, {\"status\": \"affected\", \"version\": \"17.12.2a\"}, {\"status\": \"affected\", \"version\": \"17.12.1y\"}, {\"status\": \"affected\", \"version\": \"17.12.1z\"}, {\"status\": \"affected\", \"version\": \"17.12.4\"}, {\"status\": \"affected\", \"version\": \"17.12.3a\"}, {\"status\": \"affected\", \"version\": \"17.12.1z1\"}, {\"status\": \"affected\", \"version\": \"17.12.1z2\"}, {\"status\": \"affected\", \"version\": \"17.12.4a\"}, {\"status\": \"affected\", \"version\": \"17.12.5\"}, {\"status\": \"affected\", \"version\": \"17.12.4b\"}, {\"status\": \"affected\", \"version\": \"17.12.1z3\"}, {\"status\": \"affected\", \"version\": \"17.12.5a\"}, {\"status\": \"affected\", \"version\": \"17.12.1z4\"}, {\"status\": \"affected\", \"version\": \"17.12.5b\"}, {\"status\": \"affected\", \"version\": \"17.12.5c\"}, {\"status\": \"affected\", \"version\": \"17.12.5d\"}, {\"status\": \"affected\", \"version\": \"17.13.1\"}, {\"status\": \"affected\", \"version\": \"17.13.1a\"}, {\"status\": \"affected\", \"version\": \"17.14.1\"}, {\"status\": \"affected\", \"version\": \"17.14.1a\"}, {\"status\": \"affected\", \"version\": \"17.15.1\"}, {\"status\": \"affected\", \"version\": \"17.15.1w\"}, {\"status\": \"affected\", \"version\": \"17.15.1a\"}, {\"status\": \"affected\", \"version\": \"17.15.2\"}, {\"status\": \"affected\", \"version\": \"17.15.1b\"}, {\"status\": \"affected\", \"version\": \"17.15.1x\"}, {\"status\": \"affected\", \"version\": \"17.15.1z\"}, {\"status\": \"affected\", \"version\": \"17.15.3\"}, {\"status\": \"affected\", \"version\": \"17.15.2c\"}, {\"status\": \"affected\", \"version\": \"17.15.2a\"}, {\"status\": \"affected\", \"version\": \"17.15.1y\"}, {\"status\": \"affected\", \"version\": \"17.15.2b\"}, {\"status\": \"affected\", \"version\": \"17.15.3a\"}, {\"status\": \"affected\", \"version\": \"17.15.4\"}, {\"status\": \"affected\", \"version\": \"17.15.3b\"}, {\"status\": \"affected\", \"version\": \"17.15.4d\"}, {\"status\": \"affected\", \"version\": \"17.15.4e\"}, {\"status\": \"affected\", \"version\": \"17.16.1\"}, {\"status\": \"affected\", \"version\": \"17.16.1a\"}, {\"status\": \"affected\", \"version\": \"17.17.1\"}, {\"status\": \"affected\", \"version\": \"17.18.1\"}, {\"status\": \"affected\", \"version\": \"17.18.1w\"}, {\"status\": \"affected\", \"version\": \"17.18.1a\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is aware that a public announcement is available for the vulnerability that is described in this advisory.\\r\\n\\r\\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy\", \"name\": \"cisco-sa-iosxe-lobby-privesc-KwxBqJy\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. \\r\\n\\r This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-1286\", \"description\": \"Improper Validation of Syntactic Correctness of Input\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2026-03-25T16:08:17.586Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-20114\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-25T17:34:18.687Z\", \"dateReserved\": \"2025-10-08T11:59:15.375Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2026-03-25T16:08:17.586Z\", \"assignerShortName\": \"cisco\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
GHSA-3855-FJJH-9XH2
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-25 18:31
VLAI?
Details
A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.
This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
Severity ?
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-20114"
],
"database_specific": {
"cwe_ids": [
"CWE-1286"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T16:16:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. \n\n This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.",
"id": "GHSA-3855-fjjh-9xh2",
"modified": "2026-03-25T18:31:47Z",
"published": "2026-03-25T18:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20114"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
CISCO-SA-IOSXE-LOBBY-PRIVESC-KWXBQJY
Vulnerability from csaf_cisco - Published: 2026-03-25 16:00 - Updated: 2026-03-25 16:00Summary
Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability
Notes
Summary: A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.
This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"].
Vulnerable Products: At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco IOS XE Software and had Lobby Ambassadors configured.
For information about which Cisco software releases are vulnerable, see the Fixed Software ["#fs"] section of this advisory.
Determine the Device Configuration
To determine whether a device has any Lobby Ambassadors configured, use the show running-config | include lobby-admin command in privileged EXEC mode. If type lobby-admin is returned in the output at least once, as shown in the following example, the device has Lobby Ambassadors configured and is affected by this vulnerability:
Switch#show running-config | include lobby-admin
type lobby-admin
Products Confirmed Not Vulnerable: Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
IOS Software
IOS XR Software
NX-OS Software
Wireless LAN Controller (WLC) AireOS Software
Workarounds: There are no workarounds that address this vulnerability.
Fixed Software: Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"]. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (“Combined First Fixed”).
To use the tool, go to the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"] page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:
Choose which advisories the tool will search—only this advisory, only advisories with a Critical or High Security Impact Rating (SIR) ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr"], or all advisories.
Enter a release number—for example, 15.9(3)M2 or 17.3.3.
Click Check.
Only this advisory All Critical and High advisories All advisories
Vulnerability Policy: To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements: The Cisco Product Security Incident Response Team (PSIRT) is aware that a public announcement is available for the vulnerability that is described in this advisory.
The Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.
Source: Cisco would like to thank the Unit 515 team of OPSWAT for reporting this vulnerability.
Legal Disclaimer: SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT
The Cisco Support and Downloads ["https://www.cisco.com/c/en/us/support/index.html"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories ["https://www.cisco.com/go/psirt"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) ["https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"] or their contracted maintenance providers.
LEGAL DISCLAIMER DETAILS
CISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Copies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories ["https://www.cisco.com/go/psirt"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] for more information.
5.4 (Medium)
Affected products
Known affected
188 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
16.11.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.11.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.11.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.11.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.11.1s
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.5.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.11.1c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1s
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.8
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.2s
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.1s
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1t
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.2t
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.1r
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.3s
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.1t
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.7.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.1v
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.10.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.8.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.5
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.1.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.6
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.2.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1z1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.5a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.5b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.5.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.5
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.1c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.1z2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.6
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.6a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.4b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.4c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.4.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.7.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.7
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.7.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.8.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.5a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.7.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.11.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.5b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.1z1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.10.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.5
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.7
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.9
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.10.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.6
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1x1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.11.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.13.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.14.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.8
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.10
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.1y1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.3.8a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.6a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.5a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.7
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.10a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.11
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.13.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.16.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.14.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.8
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.6
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.12
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.17.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1z1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5d
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1x
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.6a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1z
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1z2
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.6.8a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.16.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.6b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.5
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.13
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.7
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5e
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.1y
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.4b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.2b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.5f
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1z3
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.5a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.1z4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.8
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.7a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.3b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.5b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1w
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
16.12.14
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.9.7b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.5c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.18.1a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4a
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4b
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4c
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.12.5d
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4s1
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
|
|
17.15.4d
Cisco / Cisco IOS XE Software
|
— |
Vendor Fix
fix
|
References
10 references
Acknowledgments
{
"document": {
"acknowledgments": [
{
"summary": "Cisco would like to thank the Unit 515 team of OPSWAT for reporting this vulnerability."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.\r\n\r\nThis vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\n\r\n\r\nThis advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [\"https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297\"].",
"title": "Summary"
},
{
"category": "general",
"text": "At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco IOS XE Software and had Lobby Ambassadors configured.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.\r\n Determine the Device Configuration\r\nTo determine whether a device has any Lobby Ambassadors configured, use the show running-config | include lobby-admin command in privileged EXEC mode. If type lobby-admin is returned in the output at least once, as shown in the following example, the device has Lobby Ambassadors configured and is affected by this vulnerability:\r\n\r\n\r\nSwitch#show running-config | include lobby-admin\r\ntype lobby-admin",
"title": "Vulnerable Products"
},
{
"category": "general",
"text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\nIOS Software\r\nIOS XR Software\r\nNX-OS Software\r\nWireless LAN Controller (WLC) AireOS Software",
"title": "Products Confirmed Not Vulnerable"
},
{
"category": "general",
"text": "There are no workarounds that address this vulnerability.",
"title": "Workarounds"
},
{
"category": "general",
"text": "Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.\r\n Cisco IOS and IOS XE Software\r\nTo help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker [\"https://sec.cloudapps.cisco.com/security/center/softwarechecker.x\"]. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory (\u201cFirst Fixed\u201d). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities that are described in all the advisories that the Software Checker identifies (\u201cCombined First Fixed\u201d).\r\n\r\nTo use the tool, go to the Cisco Software Checker [\"https://sec.cloudapps.cisco.com/security/center/softwarechecker.x\"] page and follow the instructions. Alternatively, use the following form to determine whether a release is affected by any Cisco Security Advisory. To use the form, follow these steps:\r\n\r\nChoose which advisories the tool will search\u2014only this advisory, only advisories with a Critical or High Security Impact Rating (SIR) [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr\"], or all advisories.\r\nEnter a release number\u2014for example, 15.9(3)M2 or 17.3.3.\r\nClick Check.\r\n\r\n Only this advisory All Critical and High advisories All advisories",
"title": "Fixed Software"
},
{
"category": "general",
"text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
"title": "Vulnerability Policy"
},
{
"category": "general",
"text": "The Cisco Product Security Incident Response Team (PSIRT) is aware that a public announcement is available for the vulnerability that is described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.",
"title": "Exploitation and Public Announcements"
},
{
"category": "general",
"text": "Cisco would like to thank the Unit 515 team of OPSWAT for reporting this vulnerability.",
"title": "Source"
},
{
"category": "legal_disclaimer",
"text": "SOFTWARE DOWNLOADS AND TECHNICAL SUPPORT\r\n\r\nThe Cisco Support and Downloads [\"https://www.cisco.com/c/en/us/support/index.html\"] page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. Please note that customers may download only software that was procured from Cisco directly or through a Cisco authorized reseller or partner and for which the license is still valid.\r\n\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]. Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories [\"https://www.cisco.com/go/psirt\"] for the relevant Cisco products to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"] or their contracted maintenance providers.\r\n LEGAL DISCLAIMER DETAILS\r\n\r\nCISCO DOES NOT MAKE ANY EXPRESS OR IMPLIED GUARANTEES OR WARRANTIES OF ANY KIND, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, CISCO DOES NOT GUARANTEE THE ACCURACY OR COMPLETENESS OF THIS INFORMATION. THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nCopies or summaries of the information contained in this Security Advisory may lack important information or contain factual errors. Customers are advised to visit the Cisco Security Advisories [\"https://www.cisco.com/go/psirt\"] page for the most recent version of this Security Advisory. The Cisco Product Security Incident Response Team (PSIRT) assesses only the affected and fixed release information that is documented in this advisory. See the Cisco Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] for more information.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@cisco.com",
"issuing_authority": "Cisco PSIRT",
"name": "Cisco",
"namespace": "https://wwww.cisco.com"
},
"references": [
{
"category": "self",
"summary": "Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
},
{
"category": "external",
"summary": "Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication",
"url": "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"
},
{
"category": "external",
"summary": "Cisco Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "Cisco Software Checker",
"url": "https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"
},
{
"category": "external",
"summary": "Security Impact Rating (SIR)",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#asr"
},
{
"category": "external",
"summary": "Security Vulnerability Policy",
"url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "Cisco Support and Downloads",
"url": "https://www.cisco.com/c/en/us/support/index.html"
},
{
"category": "external",
"summary": "Cisco Technical Assistance Center (TAC)",
"url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
},
{
"category": "external",
"summary": "considering software upgrades",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
},
{
"category": "external",
"summary": "the advisories",
"url": "https://www.cisco.com/go/psirt"
}
],
"title": "Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability",
"tracking": {
"current_release_date": "2026-03-25T16:00:00+00:00",
"generator": {
"date": "2026-03-27T21:19:45+00:00",
"engine": {
"name": "TVCE"
}
},
"id": "cisco-sa-iosxe-lobby-privesc-KwxBqJy",
"initial_release_date": "2026-03-25T16:00:00+00:00",
"revision_history": [
{
"date": "2026-03-25T15:51:11+00:00",
"number": "1.0.0",
"summary": "Initial public release."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "service_pack",
"name": "16.11.1",
"product": {
"name": "16.11.1",
"product_id": "CSAFPID-227918"
}
},
{
"category": "service_pack",
"name": "16.11.1a",
"product": {
"name": "16.11.1a",
"product_id": "CSAFPID-252271"
}
},
{
"category": "service_pack",
"name": "16.11.1b",
"product": {
"name": "16.11.1b",
"product_id": "CSAFPID-260741"
}
},
{
"category": "service_pack",
"name": "16.11.2",
"product": {
"name": "16.11.2",
"product_id": "CSAFPID-261240"
}
},
{
"category": "service_pack",
"name": "16.11.1s",
"product": {
"name": "16.11.1s",
"product_id": "CSAFPID-261465"
}
},
{
"category": "service_pack",
"name": "16.11.1c",
"product": {
"name": "16.11.1c",
"product_id": "CSAFPID-264096"
}
}
],
"category": "product_version",
"name": "16.11"
},
{
"branches": [
{
"category": "service_pack",
"name": "16.12.1",
"product": {
"name": "16.12.1",
"product_id": "CSAFPID-227920"
}
},
{
"category": "service_pack",
"name": "16.12.1s",
"product": {
"name": "16.12.1s",
"product_id": "CSAFPID-265735"
}
},
{
"category": "service_pack",
"name": "16.12.1a",
"product": {
"name": "16.12.1a",
"product_id": "CSAFPID-265841"
}
},
{
"category": "service_pack",
"name": "16.12.1c",
"product": {
"name": "16.12.1c",
"product_id": "CSAFPID-267110"
}
},
{
"category": "service_pack",
"name": "16.12.1w",
"product": {
"name": "16.12.1w",
"product_id": "CSAFPID-267240"
}
},
{
"category": "service_pack",
"name": "16.12.2",
"product": {
"name": "16.12.2",
"product_id": "CSAFPID-267605"
}
},
{
"category": "service_pack",
"name": "16.12.1y",
"product": {
"name": "16.12.1y",
"product_id": "CSAFPID-271938"
}
},
{
"category": "service_pack",
"name": "16.12.2a",
"product": {
"name": "16.12.2a",
"product_id": "CSAFPID-272047"
}
},
{
"category": "service_pack",
"name": "16.12.3",
"product": {
"name": "16.12.3",
"product_id": "CSAFPID-273445"
}
},
{
"category": "service_pack",
"name": "16.12.8",
"product": {
"name": "16.12.8",
"product_id": "CSAFPID-273448"
}
},
{
"category": "service_pack",
"name": "16.12.2s",
"product": {
"name": "16.12.2s",
"product_id": "CSAFPID-273509"
}
},
{
"category": "service_pack",
"name": "16.12.1x",
"product": {
"name": "16.12.1x",
"product_id": "CSAFPID-273649"
}
},
{
"category": "service_pack",
"name": "16.12.1t",
"product": {
"name": "16.12.1t",
"product_id": "CSAFPID-274832"
}
},
{
"category": "service_pack",
"name": "16.12.2t",
"product": {
"name": "16.12.2t",
"product_id": "CSAFPID-275538"
}
},
{
"category": "service_pack",
"name": "16.12.4",
"product": {
"name": "16.12.4",
"product_id": "CSAFPID-277147"
}
},
{
"category": "service_pack",
"name": "16.12.3s",
"product": {
"name": "16.12.3s",
"product_id": "CSAFPID-277255"
}
},
{
"category": "service_pack",
"name": "16.12.1z",
"product": {
"name": "16.12.1z",
"product_id": "CSAFPID-277256"
}
},
{
"category": "service_pack",
"name": "16.12.3a",
"product": {
"name": "16.12.3a",
"product_id": "CSAFPID-277321"
}
},
{
"category": "service_pack",
"name": "16.12.4a",
"product": {
"name": "16.12.4a",
"product_id": "CSAFPID-278881"
}
},
{
"category": "service_pack",
"name": "16.12.5",
"product": {
"name": "16.12.5",
"product_id": "CSAFPID-280463"
}
},
{
"category": "service_pack",
"name": "16.12.6",
"product": {
"name": "16.12.6",
"product_id": "CSAFPID-280937"
}
},
{
"category": "service_pack",
"name": "16.12.1z1",
"product": {
"name": "16.12.1z1",
"product_id": "CSAFPID-281320"
}
},
{
"category": "service_pack",
"name": "16.12.5a",
"product": {
"name": "16.12.5a",
"product_id": "CSAFPID-281438"
}
},
{
"category": "service_pack",
"name": "16.12.5b",
"product": {
"name": "16.12.5b",
"product_id": "CSAFPID-281654"
}
},
{
"category": "service_pack",
"name": "16.12.1z2",
"product": {
"name": "16.12.1z2",
"product_id": "CSAFPID-283831"
}
},
{
"category": "service_pack",
"name": "16.12.6a",
"product": {
"name": "16.12.6a",
"product_id": "CSAFPID-285325"
}
},
{
"category": "service_pack",
"name": "16.12.7",
"product": {
"name": "16.12.7",
"product_id": "CSAFPID-286031"
}
},
{
"category": "service_pack",
"name": "16.12.9",
"product": {
"name": "16.12.9",
"product_id": "CSAFPID-292510"
}
},
{
"category": "service_pack",
"name": "16.12.10",
"product": {
"name": "16.12.10",
"product_id": "CSAFPID-295421"
}
},
{
"category": "service_pack",
"name": "16.12.10a",
"product": {
"name": "16.12.10a",
"product_id": "CSAFPID-300877"
}
},
{
"category": "service_pack",
"name": "16.12.11",
"product": {
"name": "16.12.11",
"product_id": "CSAFPID-300935"
}
},
{
"category": "service_pack",
"name": "16.12.12",
"product": {
"name": "16.12.12",
"product_id": "CSAFPID-301728"
}
},
{
"category": "service_pack",
"name": "16.12.13",
"product": {
"name": "16.12.13",
"product_id": "CSAFPID-303041"
}
},
{
"category": "service_pack",
"name": "16.12.14",
"product": {
"name": "16.12.14",
"product_id": "CSAFPID-305303"
}
}
],
"category": "product_version",
"name": "16.12"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.1.1",
"product": {
"name": "17.1.1",
"product_id": "CSAFPID-245377"
}
},
{
"category": "service_pack",
"name": "17.1.1a",
"product": {
"name": "17.1.1a",
"product_id": "CSAFPID-272932"
}
},
{
"category": "service_pack",
"name": "17.1.1s",
"product": {
"name": "17.1.1s",
"product_id": "CSAFPID-274818"
}
},
{
"category": "service_pack",
"name": "17.1.2",
"product": {
"name": "17.1.2",
"product_id": "CSAFPID-277338"
}
},
{
"category": "service_pack",
"name": "17.1.1t",
"product": {
"name": "17.1.1t",
"product_id": "CSAFPID-277348"
}
},
{
"category": "service_pack",
"name": "17.1.3",
"product": {
"name": "17.1.3",
"product_id": "CSAFPID-280652"
}
}
],
"category": "product_version",
"name": "17.1"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.2.1",
"product": {
"name": "17.2.1",
"product_id": "CSAFPID-251225"
}
},
{
"category": "service_pack",
"name": "17.2.1r",
"product": {
"name": "17.2.1r",
"product_id": "CSAFPID-277194"
}
},
{
"category": "service_pack",
"name": "17.2.1a",
"product": {
"name": "17.2.1a",
"product_id": "CSAFPID-277343"
}
},
{
"category": "service_pack",
"name": "17.2.1v",
"product": {
"name": "17.2.1v",
"product_id": "CSAFPID-278002"
}
},
{
"category": "service_pack",
"name": "17.2.2",
"product": {
"name": "17.2.2",
"product_id": "CSAFPID-278504"
}
},
{
"category": "service_pack",
"name": "17.2.3",
"product": {
"name": "17.2.3",
"product_id": "CSAFPID-280939"
}
}
],
"category": "product_version",
"name": "17.2"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.3.1",
"product": {
"name": "17.3.1",
"product_id": "CSAFPID-254712"
}
},
{
"category": "service_pack",
"name": "17.3.2",
"product": {
"name": "17.3.2",
"product_id": "CSAFPID-277099"
}
},
{
"category": "service_pack",
"name": "17.3.3",
"product": {
"name": "17.3.3",
"product_id": "CSAFPID-278019"
}
},
{
"category": "service_pack",
"name": "17.3.1a",
"product": {
"name": "17.3.1a",
"product_id": "CSAFPID-279338"
}
},
{
"category": "service_pack",
"name": "17.3.1w",
"product": {
"name": "17.3.1w",
"product_id": "CSAFPID-279339"
}
},
{
"category": "service_pack",
"name": "17.3.2a",
"product": {
"name": "17.3.2a",
"product_id": "CSAFPID-280555"
}
},
{
"category": "service_pack",
"name": "17.3.1x",
"product": {
"name": "17.3.1x",
"product_id": "CSAFPID-280783"
}
},
{
"category": "service_pack",
"name": "17.3.1z",
"product": {
"name": "17.3.1z",
"product_id": "CSAFPID-281331"
}
},
{
"category": "service_pack",
"name": "17.3.3a",
"product": {
"name": "17.3.3a",
"product_id": "CSAFPID-282017"
}
},
{
"category": "service_pack",
"name": "17.3.4",
"product": {
"name": "17.3.4",
"product_id": "CSAFPID-282028"
}
},
{
"category": "service_pack",
"name": "17.3.5",
"product": {
"name": "17.3.5",
"product_id": "CSAFPID-282115"
}
},
{
"category": "service_pack",
"name": "17.3.4a",
"product": {
"name": "17.3.4a",
"product_id": "CSAFPID-284178"
}
},
{
"category": "service_pack",
"name": "17.3.6",
"product": {
"name": "17.3.6",
"product_id": "CSAFPID-284331"
}
},
{
"category": "service_pack",
"name": "17.3.4b",
"product": {
"name": "17.3.4b",
"product_id": "CSAFPID-285326"
}
},
{
"category": "service_pack",
"name": "17.3.4c",
"product": {
"name": "17.3.4c",
"product_id": "CSAFPID-285327"
}
},
{
"category": "service_pack",
"name": "17.3.5a",
"product": {
"name": "17.3.5a",
"product_id": "CSAFPID-286498"
}
},
{
"category": "service_pack",
"name": "17.3.5b",
"product": {
"name": "17.3.5b",
"product_id": "CSAFPID-287125"
}
},
{
"category": "service_pack",
"name": "17.3.7",
"product": {
"name": "17.3.7",
"product_id": "CSAFPID-290671"
}
},
{
"category": "service_pack",
"name": "17.3.8",
"product": {
"name": "17.3.8",
"product_id": "CSAFPID-295398"
}
},
{
"category": "service_pack",
"name": "17.3.8a",
"product": {
"name": "17.3.8a",
"product_id": "CSAFPID-300847"
}
}
],
"category": "product_version",
"name": "17.3"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.4.1",
"product": {
"name": "17.4.1",
"product_id": "CSAFPID-262588"
}
},
{
"category": "service_pack",
"name": "17.4.2",
"product": {
"name": "17.4.2",
"product_id": "CSAFPID-278020"
}
},
{
"category": "service_pack",
"name": "17.4.1a",
"product": {
"name": "17.4.1a",
"product_id": "CSAFPID-280770"
}
},
{
"category": "service_pack",
"name": "17.4.1b",
"product": {
"name": "17.4.1b",
"product_id": "CSAFPID-280899"
}
},
{
"category": "service_pack",
"name": "17.4.1c",
"product": {
"name": "17.4.1c",
"product_id": "CSAFPID-282116"
}
},
{
"category": "service_pack",
"name": "17.4.2a",
"product": {
"name": "17.4.2a",
"product_id": "CSAFPID-285328"
}
}
],
"category": "product_version",
"name": "17.4"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.5.1",
"product": {
"name": "17.5.1",
"product_id": "CSAFPID-262590"
}
},
{
"category": "service_pack",
"name": "17.5.1a",
"product": {
"name": "17.5.1a",
"product_id": "CSAFPID-282046"
}
}
],
"category": "product_version",
"name": "17.5"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.6.1",
"product": {
"name": "17.6.1",
"product_id": "CSAFPID-262592"
}
},
{
"category": "service_pack",
"name": "17.6.2",
"product": {
"name": "17.6.2",
"product_id": "CSAFPID-282117"
}
},
{
"category": "service_pack",
"name": "17.6.1w",
"product": {
"name": "17.6.1w",
"product_id": "CSAFPID-284161"
}
},
{
"category": "service_pack",
"name": "17.6.1a",
"product": {
"name": "17.6.1a",
"product_id": "CSAFPID-284179"
}
},
{
"category": "service_pack",
"name": "17.6.1x",
"product": {
"name": "17.6.1x",
"product_id": "CSAFPID-284740"
}
},
{
"category": "service_pack",
"name": "17.6.3",
"product": {
"name": "17.6.3",
"product_id": "CSAFPID-286409"
}
},
{
"category": "service_pack",
"name": "17.6.1y",
"product": {
"name": "17.6.1y",
"product_id": "CSAFPID-286477"
}
},
{
"category": "service_pack",
"name": "17.6.1z",
"product": {
"name": "17.6.1z",
"product_id": "CSAFPID-286544"
}
},
{
"category": "service_pack",
"name": "17.6.3a",
"product": {
"name": "17.6.3a",
"product_id": "CSAFPID-286594"
}
},
{
"category": "service_pack",
"name": "17.6.4",
"product": {
"name": "17.6.4",
"product_id": "CSAFPID-287087"
}
},
{
"category": "service_pack",
"name": "17.6.1z1",
"product": {
"name": "17.6.1z1",
"product_id": "CSAFPID-290565"
}
},
{
"category": "service_pack",
"name": "17.6.5",
"product": {
"name": "17.6.5",
"product_id": "CSAFPID-290660"
}
},
{
"category": "service_pack",
"name": "17.6.6",
"product": {
"name": "17.6.6",
"product_id": "CSAFPID-292656"
}
},
{
"category": "service_pack",
"name": "17.6.6a",
"product": {
"name": "17.6.6a",
"product_id": "CSAFPID-300848"
}
},
{
"category": "service_pack",
"name": "17.6.5a",
"product": {
"name": "17.6.5a",
"product_id": "CSAFPID-300850"
}
},
{
"category": "service_pack",
"name": "17.6.7",
"product": {
"name": "17.6.7",
"product_id": "CSAFPID-300851"
}
},
{
"category": "service_pack",
"name": "17.6.8",
"product": {
"name": "17.6.8",
"product_id": "CSAFPID-301722"
}
},
{
"category": "service_pack",
"name": "17.6.8a",
"product": {
"name": "17.6.8a",
"product_id": "CSAFPID-302974"
}
}
],
"category": "product_version",
"name": "17.6"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.7.1",
"product": {
"name": "17.7.1",
"product_id": "CSAFPID-277357"
}
},
{
"category": "service_pack",
"name": "17.7.1a",
"product": {
"name": "17.7.1a",
"product_id": "CSAFPID-285329"
}
},
{
"category": "service_pack",
"name": "17.7.1b",
"product": {
"name": "17.7.1b",
"product_id": "CSAFPID-286410"
}
},
{
"category": "service_pack",
"name": "17.7.2",
"product": {
"name": "17.7.2",
"product_id": "CSAFPID-286534"
}
}
],
"category": "product_version",
"name": "17.7"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.10.1",
"product": {
"name": "17.10.1",
"product_id": "CSAFPID-278018"
}
},
{
"category": "service_pack",
"name": "17.10.1a",
"product": {
"name": "17.10.1a",
"product_id": "CSAFPID-290580"
}
},
{
"category": "service_pack",
"name": "17.10.1b",
"product": {
"name": "17.10.1b",
"product_id": "CSAFPID-292650"
}
}
],
"category": "product_version",
"name": "17.10"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.8.1",
"product": {
"name": "17.8.1",
"product_id": "CSAFPID-278023"
}
},
{
"category": "service_pack",
"name": "17.8.1a",
"product": {
"name": "17.8.1a",
"product_id": "CSAFPID-286486"
}
}
],
"category": "product_version",
"name": "17.8"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.9.1",
"product": {
"name": "17.9.1",
"product_id": "CSAFPID-278025"
}
},
{
"category": "service_pack",
"name": "17.9.1w",
"product": {
"name": "17.9.1w",
"product_id": "CSAFPID-286802"
}
},
{
"category": "service_pack",
"name": "17.9.2",
"product": {
"name": "17.9.2",
"product_id": "CSAFPID-288221"
}
},
{
"category": "service_pack",
"name": "17.9.1a",
"product": {
"name": "17.9.1a",
"product_id": "CSAFPID-288247"
}
},
{
"category": "service_pack",
"name": "17.9.1x",
"product": {
"name": "17.9.1x",
"product_id": "CSAFPID-289372"
}
},
{
"category": "service_pack",
"name": "17.9.1y",
"product": {
"name": "17.9.1y",
"product_id": "CSAFPID-290673"
}
},
{
"category": "service_pack",
"name": "17.9.3",
"product": {
"name": "17.9.3",
"product_id": "CSAFPID-290674"
}
},
{
"category": "service_pack",
"name": "17.9.2a",
"product": {
"name": "17.9.2a",
"product_id": "CSAFPID-290675"
}
},
{
"category": "service_pack",
"name": "17.9.1x1",
"product": {
"name": "17.9.1x1",
"product_id": "CSAFPID-292876"
}
},
{
"category": "service_pack",
"name": "17.9.3a",
"product": {
"name": "17.9.3a",
"product_id": "CSAFPID-295198"
}
},
{
"category": "service_pack",
"name": "17.9.4",
"product": {
"name": "17.9.4",
"product_id": "CSAFPID-295412"
}
},
{
"category": "service_pack",
"name": "17.9.1y1",
"product": {
"name": "17.9.1y1",
"product_id": "CSAFPID-299967"
}
},
{
"category": "service_pack",
"name": "17.9.5",
"product": {
"name": "17.9.5",
"product_id": "CSAFPID-300263"
}
},
{
"category": "service_pack",
"name": "17.9.4a",
"product": {
"name": "17.9.4a",
"product_id": "CSAFPID-300845"
}
},
{
"category": "service_pack",
"name": "17.9.5a",
"product": {
"name": "17.9.5a",
"product_id": "CSAFPID-301278"
}
},
{
"category": "service_pack",
"name": "17.9.5b",
"product": {
"name": "17.9.5b",
"product_id": "CSAFPID-301619"
}
},
{
"category": "service_pack",
"name": "17.9.6",
"product": {
"name": "17.9.6",
"product_id": "CSAFPID-301723"
}
},
{
"category": "service_pack",
"name": "17.9.5c",
"product": {
"name": "17.9.5c",
"product_id": "CSAFPID-302644"
}
},
{
"category": "service_pack",
"name": "17.9.5d",
"product": {
"name": "17.9.5d",
"product_id": "CSAFPID-302784"
}
},
{
"category": "service_pack",
"name": "17.9.6a",
"product": {
"name": "17.9.6a",
"product_id": "CSAFPID-302891"
}
},
{
"category": "service_pack",
"name": "17.9.6b",
"product": {
"name": "17.9.6b",
"product_id": "CSAFPID-303015"
}
},
{
"category": "service_pack",
"name": "17.9.7",
"product": {
"name": "17.9.7",
"product_id": "CSAFPID-303042"
}
},
{
"category": "service_pack",
"name": "17.9.5e",
"product": {
"name": "17.9.5e",
"product_id": "CSAFPID-303047"
}
},
{
"category": "service_pack",
"name": "17.9.5f",
"product": {
"name": "17.9.5f",
"product_id": "CSAFPID-303316"
}
},
{
"category": "service_pack",
"name": "17.9.8",
"product": {
"name": "17.9.8",
"product_id": "CSAFPID-304035"
}
},
{
"category": "service_pack",
"name": "17.9.7a",
"product": {
"name": "17.9.7a",
"product_id": "CSAFPID-304070"
}
},
{
"category": "service_pack",
"name": "17.9.7b",
"product": {
"name": "17.9.7b",
"product_id": "CSAFPID-306388"
}
}
],
"category": "product_version",
"name": "17.9"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.11.1",
"product": {
"name": "17.11.1",
"product_id": "CSAFPID-286799"
}
},
{
"category": "service_pack",
"name": "17.11.1a",
"product": {
"name": "17.11.1a",
"product_id": "CSAFPID-294838"
}
}
],
"category": "product_version",
"name": "17.11"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.12.1",
"product": {
"name": "17.12.1",
"product_id": "CSAFPID-286801"
}
},
{
"category": "service_pack",
"name": "17.12.1w",
"product": {
"name": "17.12.1w",
"product_id": "CSAFPID-296763"
}
},
{
"category": "service_pack",
"name": "17.12.1a",
"product": {
"name": "17.12.1a",
"product_id": "CSAFPID-300012"
}
},
{
"category": "service_pack",
"name": "17.12.1x",
"product": {
"name": "17.12.1x",
"product_id": "CSAFPID-300823"
}
},
{
"category": "service_pack",
"name": "17.12.2",
"product": {
"name": "17.12.2",
"product_id": "CSAFPID-300834"
}
},
{
"category": "service_pack",
"name": "17.12.3",
"product": {
"name": "17.12.3",
"product_id": "CSAFPID-300936"
}
},
{
"category": "service_pack",
"name": "17.12.2a",
"product": {
"name": "17.12.2a",
"product_id": "CSAFPID-300948"
}
},
{
"category": "service_pack",
"name": "17.12.1y",
"product": {
"name": "17.12.1y",
"product_id": "CSAFPID-301162"
}
},
{
"category": "service_pack",
"name": "17.12.1z",
"product": {
"name": "17.12.1z",
"product_id": "CSAFPID-301254"
}
},
{
"category": "service_pack",
"name": "17.12.4",
"product": {
"name": "17.12.4",
"product_id": "CSAFPID-301716"
}
},
{
"category": "service_pack",
"name": "17.12.3a",
"product": {
"name": "17.12.3a",
"product_id": "CSAFPID-302628"
}
},
{
"category": "service_pack",
"name": "17.12.1z1",
"product": {
"name": "17.12.1z1",
"product_id": "CSAFPID-302758"
}
},
{
"category": "service_pack",
"name": "17.12.1z2",
"product": {
"name": "17.12.1z2",
"product_id": "CSAFPID-302964"
}
},
{
"category": "service_pack",
"name": "17.12.4a",
"product": {
"name": "17.12.4a",
"product_id": "CSAFPID-303024"
}
},
{
"category": "service_pack",
"name": "17.12.5",
"product": {
"name": "17.12.5",
"product_id": "CSAFPID-303034"
}
},
{
"category": "service_pack",
"name": "17.12.4b",
"product": {
"name": "17.12.4b",
"product_id": "CSAFPID-303308"
}
},
{
"category": "service_pack",
"name": "17.12.1z3",
"product": {
"name": "17.12.1z3",
"product_id": "CSAFPID-303324"
}
},
{
"category": "service_pack",
"name": "17.12.5a",
"product": {
"name": "17.12.5a",
"product_id": "CSAFPID-303361"
}
},
{
"category": "service_pack",
"name": "17.12.1z4",
"product": {
"name": "17.12.1z4",
"product_id": "CSAFPID-303470"
}
},
{
"category": "service_pack",
"name": "17.12.5b",
"product": {
"name": "17.12.5b",
"product_id": "CSAFPID-305276"
}
},
{
"category": "service_pack",
"name": "17.12.5c",
"product": {
"name": "17.12.5c",
"product_id": "CSAFPID-306389"
}
},
{
"category": "service_pack",
"name": "17.12.5d",
"product": {
"name": "17.12.5d",
"product_id": "CSAFPID-306804"
}
}
],
"category": "product_version",
"name": "17.12"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.13.1",
"product": {
"name": "17.13.1",
"product_id": "CSAFPID-295359"
}
},
{
"category": "service_pack",
"name": "17.13.1a",
"product": {
"name": "17.13.1a",
"product_id": "CSAFPID-300947"
}
}
],
"category": "product_version",
"name": "17.13"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.14.1",
"product": {
"name": "17.14.1",
"product_id": "CSAFPID-295361"
}
},
{
"category": "service_pack",
"name": "17.14.1a",
"product": {
"name": "17.14.1a",
"product_id": "CSAFPID-301611"
}
}
],
"category": "product_version",
"name": "17.14"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.15.1",
"product": {
"name": "17.15.1",
"product_id": "CSAFPID-300938"
}
},
{
"category": "service_pack",
"name": "17.15.1w",
"product": {
"name": "17.15.1w",
"product_id": "CSAFPID-301759"
}
},
{
"category": "service_pack",
"name": "17.15.1a",
"product": {
"name": "17.15.1a",
"product_id": "CSAFPID-302682"
}
},
{
"category": "service_pack",
"name": "17.15.2",
"product": {
"name": "17.15.2",
"product_id": "CSAFPID-302782"
}
},
{
"category": "service_pack",
"name": "17.15.1b",
"product": {
"name": "17.15.1b",
"product_id": "CSAFPID-302808"
}
},
{
"category": "service_pack",
"name": "17.15.1x",
"product": {
"name": "17.15.1x",
"product_id": "CSAFPID-302851"
}
},
{
"category": "service_pack",
"name": "17.15.1z",
"product": {
"name": "17.15.1z",
"product_id": "CSAFPID-302893"
}
},
{
"category": "service_pack",
"name": "17.15.3",
"product": {
"name": "17.15.3",
"product_id": "CSAFPID-303045"
}
},
{
"category": "service_pack",
"name": "17.15.2c",
"product": {
"name": "17.15.2c",
"product_id": "CSAFPID-303212"
}
},
{
"category": "service_pack",
"name": "17.15.2a",
"product": {
"name": "17.15.2a",
"product_id": "CSAFPID-303213"
}
},
{
"category": "service_pack",
"name": "17.15.1y",
"product": {
"name": "17.15.1y",
"product_id": "CSAFPID-303214"
}
},
{
"category": "service_pack",
"name": "17.15.2b",
"product": {
"name": "17.15.2b",
"product_id": "CSAFPID-303311"
}
},
{
"category": "service_pack",
"name": "17.15.3a",
"product": {
"name": "17.15.3a",
"product_id": "CSAFPID-304866"
}
},
{
"category": "service_pack",
"name": "17.15.4",
"product": {
"name": "17.15.4",
"product_id": "CSAFPID-305238"
}
},
{
"category": "service_pack",
"name": "17.15.3b",
"product": {
"name": "17.15.3b",
"product_id": "CSAFPID-305275"
}
},
{
"category": "service_pack",
"name": "17.15.4a",
"product": {
"name": "17.15.4a",
"product_id": "CSAFPID-306558"
}
},
{
"category": "service_pack",
"name": "17.15.4b",
"product": {
"name": "17.15.4b",
"product_id": "CSAFPID-306610"
}
},
{
"category": "service_pack",
"name": "17.15.4c",
"product": {
"name": "17.15.4c",
"product_id": "CSAFPID-306648"
}
},
{
"category": "service_pack",
"name": "17.15.4s1",
"product": {
"name": "17.15.4s1",
"product_id": "CSAFPID-306814"
}
},
{
"category": "service_pack",
"name": "17.15.4d",
"product": {
"name": "17.15.4d",
"product_id": "CSAFPID-306891"
}
}
],
"category": "product_version",
"name": "17.15"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.16.1",
"product": {
"name": "17.16.1",
"product_id": "CSAFPID-301219"
}
},
{
"category": "service_pack",
"name": "17.16.1a",
"product": {
"name": "17.16.1a",
"product_id": "CSAFPID-302979"
}
}
],
"category": "product_version",
"name": "17.16"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.17.1",
"product": {
"name": "17.17.1",
"product_id": "CSAFPID-302626"
}
}
],
"category": "product_version",
"name": "17.17"
},
{
"branches": [
{
"category": "service_pack",
"name": "17.18.1",
"product": {
"name": "17.18.1",
"product_id": "CSAFPID-303216"
}
},
{
"category": "service_pack",
"name": "17.18.1w",
"product": {
"name": "17.18.1w",
"product_id": "CSAFPID-305277"
}
},
{
"category": "service_pack",
"name": "17.18.1a",
"product": {
"name": "17.18.1a",
"product_id": "CSAFPID-306557"
}
}
],
"category": "product_version",
"name": "17.18"
}
],
"category": "product_family",
"name": "Cisco IOS XE Software"
}
],
"category": "vendor",
"name": "Cisco"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20114",
"ids": [
{
"system_name": "Cisco Bug ID",
"text": "CSCwq16757"
}
],
"notes": [
{
"category": "other",
"text": "Complete.",
"title": "Affected Product Comprehensiveness"
}
],
"product_status": {
"known_affected": [
"CSAFPID-227918",
"CSAFPID-227920",
"CSAFPID-245377",
"CSAFPID-251225",
"CSAFPID-252271",
"CSAFPID-254712",
"CSAFPID-260741",
"CSAFPID-261240",
"CSAFPID-261465",
"CSAFPID-262588",
"CSAFPID-262590",
"CSAFPID-262592",
"CSAFPID-264096",
"CSAFPID-265735",
"CSAFPID-265841",
"CSAFPID-267110",
"CSAFPID-267240",
"CSAFPID-267605",
"CSAFPID-271938",
"CSAFPID-272047",
"CSAFPID-272932",
"CSAFPID-273445",
"CSAFPID-273448",
"CSAFPID-273509",
"CSAFPID-273649",
"CSAFPID-274818",
"CSAFPID-274832",
"CSAFPID-275538",
"CSAFPID-277099",
"CSAFPID-277147",
"CSAFPID-277194",
"CSAFPID-277255",
"CSAFPID-277256",
"CSAFPID-277321",
"CSAFPID-277338",
"CSAFPID-277343",
"CSAFPID-277348",
"CSAFPID-277357",
"CSAFPID-278002",
"CSAFPID-278018",
"CSAFPID-278019",
"CSAFPID-278020",
"CSAFPID-278023",
"CSAFPID-278025",
"CSAFPID-278504",
"CSAFPID-278881",
"CSAFPID-279338",
"CSAFPID-279339",
"CSAFPID-280463",
"CSAFPID-280555",
"CSAFPID-280652",
"CSAFPID-280770",
"CSAFPID-280783",
"CSAFPID-280899",
"CSAFPID-280937",
"CSAFPID-280939",
"CSAFPID-281320",
"CSAFPID-281331",
"CSAFPID-281438",
"CSAFPID-281654",
"CSAFPID-282017",
"CSAFPID-282028",
"CSAFPID-282046",
"CSAFPID-282115",
"CSAFPID-282116",
"CSAFPID-282117",
"CSAFPID-283831",
"CSAFPID-284161",
"CSAFPID-284178",
"CSAFPID-284179",
"CSAFPID-284331",
"CSAFPID-284740",
"CSAFPID-285325",
"CSAFPID-285326",
"CSAFPID-285327",
"CSAFPID-285328",
"CSAFPID-285329",
"CSAFPID-286031",
"CSAFPID-286409",
"CSAFPID-286410",
"CSAFPID-286477",
"CSAFPID-286486",
"CSAFPID-286498",
"CSAFPID-286534",
"CSAFPID-286544",
"CSAFPID-286594",
"CSAFPID-286799",
"CSAFPID-286801",
"CSAFPID-286802",
"CSAFPID-287087",
"CSAFPID-287125",
"CSAFPID-288221",
"CSAFPID-288247",
"CSAFPID-289372",
"CSAFPID-290565",
"CSAFPID-290580",
"CSAFPID-290660",
"CSAFPID-290671",
"CSAFPID-290673",
"CSAFPID-290674",
"CSAFPID-290675",
"CSAFPID-292510",
"CSAFPID-292650",
"CSAFPID-292656",
"CSAFPID-292876",
"CSAFPID-294838",
"CSAFPID-295198",
"CSAFPID-295359",
"CSAFPID-295361",
"CSAFPID-295398",
"CSAFPID-295412",
"CSAFPID-295421",
"CSAFPID-296763",
"CSAFPID-299967",
"CSAFPID-300012",
"CSAFPID-300263",
"CSAFPID-300823",
"CSAFPID-300834",
"CSAFPID-300845",
"CSAFPID-300847",
"CSAFPID-300848",
"CSAFPID-300850",
"CSAFPID-300851",
"CSAFPID-300877",
"CSAFPID-300935",
"CSAFPID-300936",
"CSAFPID-300938",
"CSAFPID-300947",
"CSAFPID-300948",
"CSAFPID-301162",
"CSAFPID-301219",
"CSAFPID-301254",
"CSAFPID-301278",
"CSAFPID-301611",
"CSAFPID-301619",
"CSAFPID-301716",
"CSAFPID-301722",
"CSAFPID-301723",
"CSAFPID-301728",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302628",
"CSAFPID-302644",
"CSAFPID-302682",
"CSAFPID-302758",
"CSAFPID-302782",
"CSAFPID-302784",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302891",
"CSAFPID-302893",
"CSAFPID-302964",
"CSAFPID-302974",
"CSAFPID-302979",
"CSAFPID-303015",
"CSAFPID-303024",
"CSAFPID-303034",
"CSAFPID-303041",
"CSAFPID-303042",
"CSAFPID-303045",
"CSAFPID-303047",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303308",
"CSAFPID-303311",
"CSAFPID-303316",
"CSAFPID-303324",
"CSAFPID-303361",
"CSAFPID-303470",
"CSAFPID-304035",
"CSAFPID-304070",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305276",
"CSAFPID-305277",
"CSAFPID-305303",
"CSAFPID-306388",
"CSAFPID-306389",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306804",
"CSAFPID-306814",
"CSAFPID-306891"
]
},
"release_date": "2026-03-25T16:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Cisco has released software updates that address this vulnerability.",
"product_ids": [
"CSAFPID-227918",
"CSAFPID-227920",
"CSAFPID-245377",
"CSAFPID-251225",
"CSAFPID-252271",
"CSAFPID-254712",
"CSAFPID-260741",
"CSAFPID-261240",
"CSAFPID-261465",
"CSAFPID-262588",
"CSAFPID-262590",
"CSAFPID-262592",
"CSAFPID-264096",
"CSAFPID-265735",
"CSAFPID-265841",
"CSAFPID-267110",
"CSAFPID-267240",
"CSAFPID-267605",
"CSAFPID-271938",
"CSAFPID-272047",
"CSAFPID-272932",
"CSAFPID-273445",
"CSAFPID-273448",
"CSAFPID-273509",
"CSAFPID-273649",
"CSAFPID-274818",
"CSAFPID-274832",
"CSAFPID-275538",
"CSAFPID-277099",
"CSAFPID-277147",
"CSAFPID-277194",
"CSAFPID-277255",
"CSAFPID-277256",
"CSAFPID-277321",
"CSAFPID-277338",
"CSAFPID-277343",
"CSAFPID-277348",
"CSAFPID-277357",
"CSAFPID-278002",
"CSAFPID-278018",
"CSAFPID-278019",
"CSAFPID-278020",
"CSAFPID-278023",
"CSAFPID-278025",
"CSAFPID-278504",
"CSAFPID-278881",
"CSAFPID-279338",
"CSAFPID-279339",
"CSAFPID-280463",
"CSAFPID-280555",
"CSAFPID-280652",
"CSAFPID-280770",
"CSAFPID-280783",
"CSAFPID-280899",
"CSAFPID-280937",
"CSAFPID-280939",
"CSAFPID-281320",
"CSAFPID-281331",
"CSAFPID-281438",
"CSAFPID-281654",
"CSAFPID-282017",
"CSAFPID-282028",
"CSAFPID-282046",
"CSAFPID-282115",
"CSAFPID-282116",
"CSAFPID-282117",
"CSAFPID-283831",
"CSAFPID-284161",
"CSAFPID-284178",
"CSAFPID-284179",
"CSAFPID-284331",
"CSAFPID-284740",
"CSAFPID-285325",
"CSAFPID-285326",
"CSAFPID-285327",
"CSAFPID-285328",
"CSAFPID-285329",
"CSAFPID-286031",
"CSAFPID-286409",
"CSAFPID-286410",
"CSAFPID-286477",
"CSAFPID-286486",
"CSAFPID-286498",
"CSAFPID-286534",
"CSAFPID-286544",
"CSAFPID-286594",
"CSAFPID-286799",
"CSAFPID-286801",
"CSAFPID-286802",
"CSAFPID-287087",
"CSAFPID-287125",
"CSAFPID-288221",
"CSAFPID-288247",
"CSAFPID-289372",
"CSAFPID-290565",
"CSAFPID-290580",
"CSAFPID-290660",
"CSAFPID-290671",
"CSAFPID-290673",
"CSAFPID-290674",
"CSAFPID-290675",
"CSAFPID-292510",
"CSAFPID-292650",
"CSAFPID-292656",
"CSAFPID-292876",
"CSAFPID-294838",
"CSAFPID-295198",
"CSAFPID-295359",
"CSAFPID-295361",
"CSAFPID-295398",
"CSAFPID-295412",
"CSAFPID-295421",
"CSAFPID-296763",
"CSAFPID-299967",
"CSAFPID-300012",
"CSAFPID-300263",
"CSAFPID-300823",
"CSAFPID-300834",
"CSAFPID-300845",
"CSAFPID-300847",
"CSAFPID-300848",
"CSAFPID-300850",
"CSAFPID-300851",
"CSAFPID-300877",
"CSAFPID-300935",
"CSAFPID-300936",
"CSAFPID-300938",
"CSAFPID-300947",
"CSAFPID-300948",
"CSAFPID-301162",
"CSAFPID-301219",
"CSAFPID-301254",
"CSAFPID-301278",
"CSAFPID-301611",
"CSAFPID-301619",
"CSAFPID-301716",
"CSAFPID-301722",
"CSAFPID-301723",
"CSAFPID-301728",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302628",
"CSAFPID-302644",
"CSAFPID-302682",
"CSAFPID-302758",
"CSAFPID-302782",
"CSAFPID-302784",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302891",
"CSAFPID-302893",
"CSAFPID-302964",
"CSAFPID-302974",
"CSAFPID-302979",
"CSAFPID-303015",
"CSAFPID-303024",
"CSAFPID-303034",
"CSAFPID-303041",
"CSAFPID-303042",
"CSAFPID-303045",
"CSAFPID-303047",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303308",
"CSAFPID-303311",
"CSAFPID-303316",
"CSAFPID-303324",
"CSAFPID-303361",
"CSAFPID-303470",
"CSAFPID-304035",
"CSAFPID-304070",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305276",
"CSAFPID-305277",
"CSAFPID-305303",
"CSAFPID-306388",
"CSAFPID-306389",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306804",
"CSAFPID-306814",
"CSAFPID-306891"
],
"url": "https://software.cisco.com"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-227918",
"CSAFPID-227920",
"CSAFPID-245377",
"CSAFPID-251225",
"CSAFPID-252271",
"CSAFPID-254712",
"CSAFPID-260741",
"CSAFPID-261240",
"CSAFPID-261465",
"CSAFPID-262588",
"CSAFPID-262590",
"CSAFPID-262592",
"CSAFPID-264096",
"CSAFPID-265735",
"CSAFPID-265841",
"CSAFPID-267110",
"CSAFPID-267240",
"CSAFPID-267605",
"CSAFPID-271938",
"CSAFPID-272047",
"CSAFPID-272932",
"CSAFPID-273445",
"CSAFPID-273448",
"CSAFPID-273509",
"CSAFPID-273649",
"CSAFPID-274818",
"CSAFPID-274832",
"CSAFPID-275538",
"CSAFPID-277099",
"CSAFPID-277147",
"CSAFPID-277194",
"CSAFPID-277255",
"CSAFPID-277256",
"CSAFPID-277321",
"CSAFPID-277338",
"CSAFPID-277343",
"CSAFPID-277348",
"CSAFPID-277357",
"CSAFPID-278002",
"CSAFPID-278018",
"CSAFPID-278019",
"CSAFPID-278020",
"CSAFPID-278023",
"CSAFPID-278025",
"CSAFPID-278504",
"CSAFPID-278881",
"CSAFPID-279338",
"CSAFPID-279339",
"CSAFPID-280463",
"CSAFPID-280555",
"CSAFPID-280652",
"CSAFPID-280770",
"CSAFPID-280783",
"CSAFPID-280899",
"CSAFPID-280937",
"CSAFPID-280939",
"CSAFPID-281320",
"CSAFPID-281331",
"CSAFPID-281438",
"CSAFPID-281654",
"CSAFPID-282017",
"CSAFPID-282028",
"CSAFPID-282046",
"CSAFPID-282115",
"CSAFPID-282116",
"CSAFPID-282117",
"CSAFPID-283831",
"CSAFPID-284161",
"CSAFPID-284178",
"CSAFPID-284179",
"CSAFPID-284331",
"CSAFPID-284740",
"CSAFPID-285325",
"CSAFPID-285326",
"CSAFPID-285327",
"CSAFPID-285328",
"CSAFPID-285329",
"CSAFPID-286031",
"CSAFPID-286409",
"CSAFPID-286410",
"CSAFPID-286477",
"CSAFPID-286486",
"CSAFPID-286498",
"CSAFPID-286534",
"CSAFPID-286544",
"CSAFPID-286594",
"CSAFPID-286799",
"CSAFPID-286801",
"CSAFPID-286802",
"CSAFPID-287087",
"CSAFPID-287125",
"CSAFPID-288221",
"CSAFPID-288247",
"CSAFPID-289372",
"CSAFPID-290565",
"CSAFPID-290580",
"CSAFPID-290660",
"CSAFPID-290671",
"CSAFPID-290673",
"CSAFPID-290674",
"CSAFPID-290675",
"CSAFPID-292510",
"CSAFPID-292650",
"CSAFPID-292656",
"CSAFPID-292876",
"CSAFPID-294838",
"CSAFPID-295198",
"CSAFPID-295359",
"CSAFPID-295361",
"CSAFPID-295398",
"CSAFPID-295412",
"CSAFPID-295421",
"CSAFPID-296763",
"CSAFPID-299967",
"CSAFPID-300012",
"CSAFPID-300263",
"CSAFPID-300823",
"CSAFPID-300834",
"CSAFPID-300845",
"CSAFPID-300847",
"CSAFPID-300848",
"CSAFPID-300850",
"CSAFPID-300851",
"CSAFPID-300877",
"CSAFPID-300935",
"CSAFPID-300936",
"CSAFPID-300938",
"CSAFPID-300947",
"CSAFPID-300948",
"CSAFPID-301162",
"CSAFPID-301219",
"CSAFPID-301254",
"CSAFPID-301278",
"CSAFPID-301611",
"CSAFPID-301619",
"CSAFPID-301716",
"CSAFPID-301722",
"CSAFPID-301723",
"CSAFPID-301728",
"CSAFPID-301759",
"CSAFPID-302626",
"CSAFPID-302628",
"CSAFPID-302644",
"CSAFPID-302682",
"CSAFPID-302758",
"CSAFPID-302782",
"CSAFPID-302784",
"CSAFPID-302808",
"CSAFPID-302851",
"CSAFPID-302891",
"CSAFPID-302893",
"CSAFPID-302964",
"CSAFPID-302974",
"CSAFPID-302979",
"CSAFPID-303015",
"CSAFPID-303024",
"CSAFPID-303034",
"CSAFPID-303041",
"CSAFPID-303042",
"CSAFPID-303045",
"CSAFPID-303047",
"CSAFPID-303212",
"CSAFPID-303213",
"CSAFPID-303214",
"CSAFPID-303216",
"CSAFPID-303308",
"CSAFPID-303311",
"CSAFPID-303316",
"CSAFPID-303324",
"CSAFPID-303361",
"CSAFPID-303470",
"CSAFPID-304035",
"CSAFPID-304070",
"CSAFPID-304866",
"CSAFPID-305238",
"CSAFPID-305275",
"CSAFPID-305276",
"CSAFPID-305277",
"CSAFPID-305303",
"CSAFPID-306388",
"CSAFPID-306389",
"CSAFPID-306557",
"CSAFPID-306558",
"CSAFPID-306610",
"CSAFPID-306648",
"CSAFPID-306804",
"CSAFPID-306814",
"CSAFPID-306891"
]
}
],
"title": "Cisco IOS XE Software Lobby Ambassador Privilege Escalation Vulnerability"
}
]
}
NCSC-2026-0104
Vulnerability from csaf_ncscnl - Published: 2026-03-26 09:50 - Updated: 2026-03-26 09:50Summary
Kwetsbaarheden verholpen in Cisco IOS XE Software
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software, specifiek voor verschillende producten zoals Catalyst 9000 Series Switches, Catalyst CW9800 Family, en Cisco Meraki.
Interpretaties: De kwetsbaarheden omvatten verschillende problemen, zoals een geheugenlek in de IKEv2-implementatie, kwetsbaarheden in de DHCP-snooping functie, en onjuiste verwerking van CAPWAP-pakketten die leiden tot een denial of service. Daarnaast zijn er kwetsbaarheden gerapporteerd die het mogelijk maken voor ongeauthenticeerde aanvallers om toegang te krijgen tot gevoelige apparaatconfiguraties en om privileges te verhogen via de Lobby Ambassador API. Ook zijn er problemen met onjuiste privilege-toewijzingen en een kritieke kwetsbaarheid in de bootloader die lokale of fysieke toegang vereisen voor exploitatie. De SCP-serverfunctie is ook kwetsbaar voor denial of service door onjuiste verwerking van SCP-verzoeken.
Oplossingen: Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-228: Improper Handling of Syntactically Invalid Structure
CWE-230: Improper Handling of Missing Values
CWE-235: Improper Handling of Extra Parameters
CWE-266: Incorrect Privilege Assignment
CWE-319: Cleartext Transmission of Sensitive Information
CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-771: Missing Reference to Active Allocated Resource
CWE-1286: Improper Validation of Syntactic Correctness of Input
A vulnerability in the IKEv2 feature of multiple Cisco software products allows an unauthenticated remote attacker to cause a memory leak resulting in denial of service, necessitating a manual reboot to restore service.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE's DHCP snooping feature on Catalyst 9000 Series Switches allows unauthenticated remote attackers to forward BOOTP packets between VLANs, causing VLAN leakage, high CPU usage, and denial of service.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family allows unauthenticated remote attackers to cause denial of service by sending malformed CAPWAP packets, resulting in device reloads.
8.6 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in the TLS library of Cisco IOS XE Software allows an unauthenticated, adjacent attacker to exhaust device memory during TLS connection setup due to improper memory management, potentially causing denial of service.
7.4 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE Software for Cisco Meraki allows remote, unauthenticated attackers to access confidential device information by exploiting insecure device configuration uploads via an on-path attack.
6.1 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
An authenticated remote attacker can exploit a vulnerability in the HTTP Server feature of Cisco IOS and IOS XE Software Release 3E by sending malformed HTTP requests, causing an unexpected device reload and denial of service.
7.7 (High)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE's Lobby Ambassador web-based management API allows authenticated remote attackers to elevate privileges by exploiting insufficient parameter validation, potentially creating new users with elevated access.
5.4 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in Cisco IOS XE CLI allows an authenticated local attacker to cause a denial of service by exploiting incorrect privileges on the start maintenance command, which puts the device into maintenance mode and shuts down interfaces.
6.5 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A bootloader vulnerability in Cisco IOS XE Software for Cisco Catalyst 9200 Series and Rugged Series Switches allows local attackers to execute arbitrary code at boot time, bypassing integrity checks and signed image requirements.
6.1 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
A vulnerability in the SCP server feature of Cisco IOS XE Software allows an authenticated local attacker with low privileges to cause a denial of service by sending a malformed SCP request via SSH, potentially causing device reloads.
6.5 (Medium)
Affected products
Known affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Cisco / Cisco 3000 Series Industrial Security Appliances (ISA)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco ASA 5500-X Series Firewalls
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Adaptive Security Virtual Appliance (ASAv)
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 1000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 2100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Firepower 9000 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco IOS XE Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 3100 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall 4200 Series
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / Cisco Secure Firewall Threat Defense (FTD) Software
|
vers:unknown/* | ||
|
vers:unknown/*
Cisco / IOS
|
vers:unknown/* |
References
21 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Cisco heeft kwetsbaarheden verholpen in Cisco IOS XE Software, specifiek voor verschillende producten zoals Catalyst 9000 Series Switches, Catalyst CW9800 Family, en Cisco Meraki.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten verschillende problemen, zoals een geheugenlek in de IKEv2-implementatie, kwetsbaarheden in de DHCP-snooping functie, en onjuiste verwerking van CAPWAP-pakketten die leiden tot een denial of service. Daarnaast zijn er kwetsbaarheden gerapporteerd die het mogelijk maken voor ongeauthenticeerde aanvallers om toegang te krijgen tot gevoelige apparaatconfiguraties en om privileges te verhogen via de Lobby Ambassador API. Ook zijn er problemen met onjuiste privilege-toewijzingen en een kritieke kwetsbaarheid in de bootloader die lokale of fysieke toegang vereisen voor exploitatie. De SCP-serverfunctie is ook kwetsbaar voor denial of service door onjuiste verwerking van SCP-verzoeken.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
"title": "CWE-124"
},
{
"category": "general",
"text": "Improper Handling of Syntactically Invalid Structure",
"title": "CWE-228"
},
{
"category": "general",
"text": "Improper Handling of Missing Values",
"title": "CWE-230"
},
{
"category": "general",
"text": "Improper Handling of Extra Parameters",
"title": "CWE-235"
},
{
"category": "general",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "general",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "Missing Reference to Active Allocated Resource",
"title": "CWE-771"
},
{
"category": "general",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-ios-dos-kPEpQGGK"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bootp-WuBhNBxA"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-dos-sbv8XRpL"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks#fs"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-tls-dos-TVgLDEZL"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe_infodis-6J847uEB"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-scp-dos-duAdXtCg"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-hnX5KGOm"
},
{
"category": "external",
"summary": "Reference",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xe-secureboot-bypass-B6uYxYSZ"
}
],
"title": "Kwetsbaarheden verholpen in Cisco IOS XE Software",
"tracking": {
"current_release_date": "2026-03-26T09:50:03.269095Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0104",
"initial_release_date": "2026-03-26T09:50:03.269095Z",
"revision_history": [
{
"date": "2026-03-26T09:50:03.269095Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Cisco 3000 Series Industrial Security Appliances (ISA)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Cisco ASA 5500-X Series Firewalls"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Cisco Adaptive Security Virtual Appliance (ASAv)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 1000 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 2100 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Cisco Firepower 9000 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Cisco IOS XE Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall 3100 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall 4200 Series"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Cisco Secure Firewall Threat Defense (FTD) Software"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "IOS"
}
],
"category": "vendor",
"name": "Cisco"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20012",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "description",
"text": "A vulnerability in the IKEv2 feature of multiple Cisco software products allows an unauthenticated remote attacker to cause a memory leak resulting in denial of service, necessitating a manual reboot to restore service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20012 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20012.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20012"
},
{
"cve": "CVE-2026-20084",
"notes": [
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE\u0027s DHCP snooping feature on Catalyst 9000 Series Switches allows unauthenticated remote attackers to forward BOOTP packets between VLANs, causing VLAN leakage, high CPU usage, and denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20084"
},
{
"cve": "CVE-2026-20086",
"cwe": {
"id": "CWE-230",
"name": "Improper Handling of Missing Values"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Missing Values",
"title": "CWE-230"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family allows unauthenticated remote attackers to cause denial of service by sending malformed CAPWAP packets, resulting in device reloads.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20086 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20086.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20086"
},
{
"cve": "CVE-2026-20004",
"cwe": {
"id": "CWE-771",
"name": "Missing Reference to Active Allocated Resource"
},
"notes": [
{
"category": "other",
"text": "Missing Reference to Active Allocated Resource",
"title": "CWE-771"
},
{
"category": "description",
"text": "A vulnerability in the TLS library of Cisco IOS XE Software allows an unauthenticated, adjacent attacker to exhaust device memory during TLS connection setup due to improper memory management, potentially causing denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20004 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20004.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20004"
},
{
"cve": "CVE-2026-20115",
"cwe": {
"id": "CWE-319",
"name": "Cleartext Transmission of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE Software for Cisco Meraki allows remote, unauthenticated attackers to access confidential device information by exploiting insecure device configuration uploads via an on-path attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20115 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20115.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20115"
},
{
"cve": "CVE-2026-20125",
"cwe": {
"id": "CWE-228",
"name": "Improper Handling of Syntactically Invalid Structure"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Syntactically Invalid Structure",
"title": "CWE-228"
},
{
"category": "description",
"text": "An authenticated remote attacker can exploit a vulnerability in the HTTP Server feature of Cisco IOS and IOS XE Software Release 3E by sending malformed HTTP requests, causing an unexpected device reload and denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20125 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20125.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20125"
},
{
"cve": "CVE-2026-20114",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE\u0027s Lobby Ambassador web-based management API allows authenticated remote attackers to elevate privileges by exploiting insufficient parameter validation, potentially creating new users with elevated access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20114 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20114.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20114"
},
{
"cve": "CVE-2026-20110",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"notes": [
{
"category": "other",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "description",
"text": "A vulnerability in Cisco IOS XE CLI allows an authenticated local attacker to cause a denial of service by exploiting incorrect privileges on the start maintenance command, which puts the device into maintenance mode and shuts down interfaces.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20110 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20110.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20110"
},
{
"cve": "CVE-2026-20104",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
"title": "CWE-124"
},
{
"category": "description",
"text": "A bootloader vulnerability in Cisco IOS XE Software for Cisco Catalyst 9200 Series and Rugged Series Switches allows local attackers to execute arbitrary code at boot time, bypassing integrity checks and signed image requirements.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20104 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20104.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20104"
},
{
"cve": "CVE-2026-20083",
"cwe": {
"id": "CWE-235",
"name": "Improper Handling of Extra Parameters"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Extra Parameters",
"title": "CWE-235"
},
{
"category": "description",
"text": "A vulnerability in the SCP server feature of Cisco IOS XE Software allows an authenticated local attacker with low privileges to cause a denial of service by sending a malformed SCP request via SSH, potentially causing device reloads.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20083 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20083.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12"
]
}
],
"title": "CVE-2026-20083"
}
]
}
FKIE_CVE-2026-20114
Vulnerability from fkie_nvd - Published: 2026-03-25 16:16 - Updated: 2026-03-26 15:13
Severity ?
Summary
A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.
This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. \r\n\r This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la API de gesti\u00f3n basada en web de Lobby Ambassador de Cisco IOS XE Software podr\u00eda permitir a un atacante remoto autenticado elevar sus privilegios y acceder a APIs de gesti\u00f3n que normalmente no estar\u00edan disponibles para usuarios de Lobby Ambassador. Esta vulnerabilidad existe porque los par\u00e1metros que son recibidos por un endpoint de API no son validados suficientemente. Un atacante podr\u00eda explotar esta vulnerabilidad autentic\u00e1ndose como un usuario de Lobby Ambassador y enviando una solicitud HTTP manipulada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante crear un nuevo usuario con acceso de nivel de privilegio 1 a la API de gesti\u00f3n basada en web. El atacante podr\u00eda entonces acceder al dispositivo con estas nuevas credenciales y privilegios."
}
],
"id": "CVE-2026-20114",
"lastModified": "2026-03-26T15:13:15.790",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "psirt@cisco.com",
"type": "Primary"
}
]
},
"published": "2026-03-25T16:16:16.117",
"references": [
{
"source": "psirt@cisco.com",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy"
}
],
"sourceIdentifier": "psirt@cisco.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1286"
}
],
"source": "psirt@cisco.com",
"type": "Primary"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…