Vulnerability-Lookup

CVE-2026-20184 (GCVE-0-2026-20184)

Vulnerability from cvelistv5 – Published: 2026-04-15 16:03 – Updated: 2026-04-16 19:07

Title

Cisco Webex Meetings Certificate Validation Vulnerability

Summary

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-15 00:00 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

cisco CNA under the mitre root

CNA scorecard C 66/100 over 431 records in the last 180 days details

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version	CPE status
Cisco	Cisco Webex Meetings	Affected: 39.7.7 Affected: 39.9 Affected: 40.4.10 Affected: 39.6 Affected: 40.6.2 Affected: 39.8.2 Affected: 39.8.4 Affected: 40.1 Affected: 39.11 Affected: 39.7.4 Affected: 39.9.1 Affected: 40.4 Affected: 40.6 Affected: 39.7 Affected: 39.8 Affected: 39.8.3 Affected: 40.2 Affected: 39.10 Affected: 42.6 Affected: 42.7 Affected: 42.8 Affected: 42.9 Affected: 42.10 Affected: 42.11 Affected: 42.12 Affected: 43.1 Affected: 43.2 Affected: 43.3 Affected: 43.4 Affected: 43.4.1 Affected: 43.4.2 Affected: 43.5.0 Affected: 43.6.0 Affected: 43.6.1 Affected: 43.7 Affected: 43.8 Affected: 43.9 Affected: 43.10 Affected: 43.11 Affected: 43.12 Affected: 44.1 Affected: 44.2 Affected: 44.3 Affected: 44.4 Affected: 44.5 Affected: 44.6 Affected: 44.7 Affected: 44.8 Affected: 44.9 Affected: 44.10 Affected: 44.11 Affected: 44.12 Affected: 45.1 Affected: 45.2 Affected: 45.3 Affected: 45.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20184",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T03:55:32.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Webex Meetings",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "39.7.7"
            },
            {
              "status": "affected",
              "version": "39.9"
            },
            {
              "status": "affected",
              "version": "40.4.10"
            },
            {
              "status": "affected",
              "version": "39.6"
            },
            {
              "status": "affected",
              "version": "40.6.2"
            },
            {
              "status": "affected",
              "version": "39.8.2"
            },
            {
              "status": "affected",
              "version": "39.8.4"
            },
            {
              "status": "affected",
              "version": "40.1"
            },
            {
              "status": "affected",
              "version": "39.11"
            },
            {
              "status": "affected",
              "version": "39.7.4"
            },
            {
              "status": "affected",
              "version": "39.9.1"
            },
            {
              "status": "affected",
              "version": "40.4"
            },
            {
              "status": "affected",
              "version": "40.6"
            },
            {
              "status": "affected",
              "version": "39.7"
            },
            {
              "status": "affected",
              "version": "39.8"
            },
            {
              "status": "affected",
              "version": "39.8.3"
            },
            {
              "status": "affected",
              "version": "40.2"
            },
            {
              "status": "affected",
              "version": "39.10"
            },
            {
              "status": "affected",
              "version": "42.6"
            },
            {
              "status": "affected",
              "version": "42.7"
            },
            {
              "status": "affected",
              "version": "42.8"
            },
            {
              "status": "affected",
              "version": "42.9"
            },
            {
              "status": "affected",
              "version": "42.10"
            },
            {
              "status": "affected",
              "version": "42.11"
            },
            {
              "status": "affected",
              "version": "42.12"
            },
            {
              "status": "affected",
              "version": "43.1"
            },
            {
              "status": "affected",
              "version": "43.2"
            },
            {
              "status": "affected",
              "version": "43.3"
            },
            {
              "status": "affected",
              "version": "43.4"
            },
            {
              "status": "affected",
              "version": "43.4.1"
            },
            {
              "status": "affected",
              "version": "43.4.2"
            },
            {
              "status": "affected",
              "version": "43.5.0"
            },
            {
              "status": "affected",
              "version": "43.6.0"
            },
            {
              "status": "affected",
              "version": "43.6.1"
            },
            {
              "status": "affected",
              "version": "43.7"
            },
            {
              "status": "affected",
              "version": "43.8"
            },
            {
              "status": "affected",
              "version": "43.9"
            },
            {
              "status": "affected",
              "version": "43.10"
            },
            {
              "status": "affected",
              "version": "43.11"
            },
            {
              "status": "affected",
              "version": "43.12"
            },
            {
              "status": "affected",
              "version": "44.1"
            },
            {
              "status": "affected",
              "version": "44.2"
            },
            {
              "status": "affected",
              "version": "44.3"
            },
            {
              "status": "affected",
              "version": "44.4"
            },
            {
              "status": "affected",
              "version": "44.5"
            },
            {
              "status": "affected",
              "version": "44.6"
            },
            {
              "status": "affected",
              "version": "44.7"
            },
            {
              "status": "affected",
              "version": "44.8"
            },
            {
              "status": "affected",
              "version": "44.9"
            },
            {
              "status": "affected",
              "version": "44.10"
            },
            {
              "status": "affected",
              "version": "44.11"
            },
            {
              "status": "affected",
              "version": "44.12"
            },
            {
              "status": "affected",
              "version": "45.1"
            },
            {
              "status": "affected",
              "version": "45.2"
            },
            {
              "status": "affected",
              "version": "45.3"
            },
            {
              "status": "affected",
              "version": "45.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.\r\n\r\nThis vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-16T19:07:14.461Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-webex-cui-cert-8jSZYhWL",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL"
        }
      ],
      "source": {
        "advisory": "cisco-sa-webex-cui-cert-8jSZYhWL",
        "defects": [
          "CSCwt37111"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Webex Meetings Certificate Validation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20184",
    "datePublished": "2026-04-15T16:03:59.646Z",
    "dateReserved": "2025-10-08T11:59:15.394Z",
    "dateUpdated": "2026-04-16T19:07:14.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-20184",
      "date": "2026-11-15",
      "epss": "0.00529",
      "percentile": "0.45306"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "Cisco Webex Meetings",
                "vendor": "Cisco",
                "versions": [
                  {
                    "status": "affected",
                    "version": "39.7.7"
                  },
                  {
                    "status": "affected",
                    "version": "39.9"
                  },
                  {
                    "status": "affected",
                    "version": "40.4.10"
                  },
                  {
                    "status": "affected",
                    "version": "39.6"
                  },
                  {
                    "status": "affected",
                    "version": "40.6.2"
                  },
                  {
                    "status": "affected",
                    "version": "39.8.2"
                  },
                  {
                    "status": "affected",
                    "version": "39.8.4"
                  },
                  {
                    "status": "affected",
                    "version": "40.1"
                  },
                  {
                    "status": "affected",
                    "version": "39.11"
                  },
                  {
                    "status": "affected",
                    "version": "39.7.4"
                  },
                  {
                    "status": "affected",
                    "version": "39.9.1"
                  },
                  {
                    "status": "affected",
                    "version": "40.4"
                  },
                  {
                    "status": "affected",
                    "version": "40.6"
                  },
                  {
                    "status": "affected",
                    "version": "39.7"
                  },
                  {
                    "status": "affected",
                    "version": "39.8"
                  },
                  {
                    "status": "affected",
                    "version": "39.8.3"
                  },
                  {
                    "status": "affected",
                    "version": "40.2"
                  },
                  {
                    "status": "affected",
                    "version": "39.10"
                  },
                  {
                    "status": "affected",
                    "version": "42.6"
                  },
                  {
                    "status": "affected",
                    "version": "42.7"
                  },
                  {
                    "status": "affected",
                    "version": "42.8"
                  },
                  {
                    "status": "affected",
                    "version": "42.9"
                  },
                  {
                    "status": "affected",
                    "version": "42.10"
                  },
                  {
                    "status": "affected",
                    "version": "42.11"
                  },
                  {
                    "status": "affected",
                    "version": "42.12"
                  },
                  {
                    "status": "affected",
                    "version": "43.1"
                  },
                  {
                    "status": "affected",
                    "version": "43.2"
                  },
                  {
                    "status": "affected",
                    "version": "43.3"
                  },
                  {
                    "status": "affected",
                    "version": "43.4"
                  },
                  {
                    "status": "affected",
                    "version": "43.4.1"
                  },
                  {
                    "status": "affected",
                    "version": "43.4.2"
                  },
                  {
                    "status": "affected",
                    "version": "43.5.0"
                  },
                  {
                    "status": "affected",
                    "version": "43.6.0"
                  },
                  {
                    "status": "affected",
                    "version": "43.6.1"
                  },
                  {
                    "status": "affected",
                    "version": "43.7"
                  },
                  {
                    "status": "affected",
                    "version": "43.8"
                  },
                  {
                    "status": "affected",
                    "version": "43.9"
                  },
                  {
                    "status": "affected",
                    "version": "43.10"
                  },
                  {
                    "status": "affected",
                    "version": "43.11"
                  },
                  {
                    "status": "affected",
                    "version": "43.12"
                  },
                  {
                    "status": "affected",
                    "version": "44.1"
                  },
                  {
                    "status": "affected",
                    "version": "44.2"
                  },
                  {
                    "status": "affected",
                    "version": "44.3"
                  },
                  {
                    "status": "affected",
                    "version": "44.4"
                  },
                  {
                    "status": "affected",
                    "version": "44.5"
                  },
                  {
                    "status": "affected",
                    "version": "44.6"
                  },
                  {
                    "status": "affected",
                    "version": "44.7"
                  },
                  {
                    "status": "affected",
                    "version": "44.8"
                  },
                  {
                    "status": "affected",
                    "version": "44.9"
                  },
                  {
                    "status": "affected",
                    "version": "44.10"
                  },
                  {
                    "status": "affected",
                    "version": "44.11"
                  },
                  {
                    "status": "affected",
                    "version": "44.12"
                  },
                  {
                    "status": "affected",
                    "version": "45.1"
                  },
                  {
                    "status": "affected",
                    "version": "45.2"
                  },
                  {
                    "status": "affected",
                    "version": "45.3"
                  },
                  {
                    "status": "affected",
                    "version": "45.4"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.\r\n\r\nThis vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad en la integraci\u00f3n de inicio de sesi\u00f3n \u00fanico (SSO) con Control Hub en los servicios de Cisco Webex podr\u00eda haber permitido a un atacante remoto no autenticado suplantar a cualquier usuario dentro del servicio.\n\nEsta vulnerabilidad exist\u00eda debido a una validaci\u00f3n de certificado incorrecta. Antes de que esta vulnerabilidad fuera abordada, un atacante podr\u00eda haber explotado esta vulnerabilidad conect\u00e1ndose a un punto final de servicio y proporcionando un token manipulado. Un exploit exitoso podr\u00eda haber permitido al atacante obtener acceso no autorizado a servicios leg\u00edtimos de Cisco Webex."
          }
        ],
        "id": "CVE-2026-20184",
        "lastModified": "2026-10-26T22:10:00.163",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-20184",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-04-15T17:17:03.677",
        "references": [
          {
            "source": "psirt@cisco.com",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-295"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-04-16T19:22:25+00:00",
      "cve": "CVE-2026-20184",
      "id": "CVE-2026-20184",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cisco Webex Meetings Certificate Validation Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-20184.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-20184",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-15T16:45:03.876078Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-15T16:56:20.681Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "Cisco Webex Meetings",
              "vendor": "Cisco",
              "versions": [
                {
                  "status": "affected",
                  "version": "39.7.7"
                },
                {
                  "status": "affected",
                  "version": "39.9"
                },
                {
                  "status": "affected",
                  "version": "40.4.10"
                },
                {
                  "status": "affected",
                  "version": "39.6"
                },
                {
                  "status": "affected",
                  "version": "40.6.2"
                },
                {
                  "status": "affected",
                  "version": "39.8.2"
                },
                {
                  "status": "affected",
                  "version": "39.8.4"
                },
                {
                  "status": "affected",
                  "version": "40.1"
                },
                {
                  "status": "affected",
                  "version": "39.11"
                },
                {
                  "status": "affected",
                  "version": "39.7.4"
                },
                {
                  "status": "affected",
                  "version": "39.9.1"
                },
                {
                  "status": "affected",
                  "version": "40.4"
                },
                {
                  "status": "affected",
                  "version": "40.6"
                },
                {
                  "status": "affected",
                  "version": "39.7"
                },
                {
                  "status": "affected",
                  "version": "39.8"
                },
                {
                  "status": "affected",
                  "version": "39.8.3"
                },
                {
                  "status": "affected",
                  "version": "40.2"
                },
                {
                  "status": "affected",
                  "version": "39.10"
                },
                {
                  "status": "affected",
                  "version": "42.6"
                },
                {
                  "status": "affected",
                  "version": "42.7"
                },
                {
                  "status": "affected",
                  "version": "42.8"
                },
                {
                  "status": "affected",
                  "version": "42.9"
                },
                {
                  "status": "affected",
                  "version": "42.10"
                },
                {
                  "status": "affected",
                  "version": "42.11"
                },
                {
                  "status": "affected",
                  "version": "42.12"
                },
                {
                  "status": "affected",
                  "version": "43.1"
                },
                {
                  "status": "affected",
                  "version": "43.2"
                },
                {
                  "status": "affected",
                  "version": "43.3"
                },
                {
                  "status": "affected",
                  "version": "43.4"
                },
                {
                  "status": "affected",
                  "version": "43.4.1"
                },
                {
                  "status": "affected",
                  "version": "43.4.2"
                },
                {
                  "status": "affected",
                  "version": "43.5.0"
                },
                {
                  "status": "affected",
                  "version": "43.6.0"
                },
                {
                  "status": "affected",
                  "version": "43.6.1"
                },
                {
                  "status": "affected",
                  "version": "43.7"
                },
                {
                  "status": "affected",
                  "version": "43.8"
                },
                {
                  "status": "affected",
                  "version": "43.9"
                },
                {
                  "status": "affected",
                  "version": "43.10"
                },
                {
                  "status": "affected",
                  "version": "43.11"
                },
                {
                  "status": "affected",
                  "version": "43.12"
                },
                {
                  "status": "affected",
                  "version": "44.1"
                },
                {
                  "status": "affected",
                  "version": "44.2"
                },
                {
                  "status": "affected",
                  "version": "44.3"
                },
                {
                  "status": "affected",
                  "version": "44.4"
                },
                {
                  "status": "affected",
                  "version": "44.5"
                },
                {
                  "status": "affected",
                  "version": "44.6"
                },
                {
                  "status": "affected",
                  "version": "44.7"
                },
                {
                  "status": "affected",
                  "version": "44.8"
                },
                {
                  "status": "affected",
                  "version": "44.9"
                },
                {
                  "status": "affected",
                  "version": "44.10"
                },
                {
                  "status": "affected",
                  "version": "44.11"
                },
                {
                  "status": "affected",
                  "version": "44.12"
                },
                {
                  "status": "affected",
                  "version": "45.1"
                },
                {
                  "status": "affected",
                  "version": "45.2"
                },
                {
                  "status": "affected",
                  "version": "45.3"
                },
                {
                  "status": "affected",
                  "version": "45.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.\r\n\r\nThis vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "cvssV3_1"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "Improper Certificate Validation",
                  "lang": "en",
                  "type": "cwe"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-16T19:07:14.461Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "name": "cisco-sa-webex-cui-cert-8jSZYhWL",
              "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL"
            }
          ],
          "source": {
            "advisory": "cisco-sa-webex-cui-cert-8jSZYhWL",
            "defects": [
              "CSCwt37111"
            ],
            "discovery": "INTERNAL"
          },
          "title": "Cisco Webex Meetings Certificate Validation Vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2026-20184",
        "datePublished": "2026-04-15T16:03:59.646Z",
        "dateReserved": "2025-10-08T11:59:15.394Z",
        "dateUpdated": "2026-04-16T19:07:14.461Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-05532 (CVE-2026-20184)

Vulnerability from fstec – Published: 2026-04-17 – Updated: 2026-04-17 – View on bdu.fstec.ru Fixed

Title

Уязвимость облачной платформы для веб-конференцсвязи Cisco Webex, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость облачной платформы для веб-конференцсвязи Cisco Webex связана с ошибками процедуры подтверждения подлинности сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Being clarified

Remediation

Software update

CWE

CWE-295 - Неправильное подтверждение подлинности сертификата

Aliases

CVE-2026-20184

References

1 reference

URL
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/c…

Impacted products

1 product from 2 vendors

Vendors

Cisco Systems, Inc.

Products

Cisco Webex Centers

Versions

- (Cisco Webex Centers)

Product types

Network software

Mitigations

Использование рекомендаций производителя: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Cisco Webex Centers)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "17.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.04.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-05532",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-20184",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Cisco Webex Centers",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0432\u0435\u0431-\u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0441\u0432\u044f\u0437\u0438 Cisco Webex, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 (CWE-295)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0432\u0435\u0431-\u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0441\u0432\u044f\u0437\u0438 Cisco Webex \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-295",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CERTFR-2026-AVI-0451

Vulnerability from certfr_avis - Published: 2026-04-16 - Updated: 2026-04-16

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	Identity Services Engine	ISE et ISE-PIC version 3.4 sans les correctifs de sécurité Patch 4 et 6 (disponible avril 2026)
Cisco	Identity Services Engine	ISE et ISE-PIC version 3.3 sans les correctifs de sécurité Patch 8 et 11 (disponible avril 2026)
Cisco	Identity Services Engine	ISE et ISE-PIC versions antérieures à 3.2 sans les correctifs de sécurité Patch 8 et 10 (disponible avril 2026)
Cisco	Webex	Webex, la vulnérabilité CVE-2026-20184 a été corrigée par Cisco, aucune action utilisateur n'est requise, sauf en cas d'utilisation du SSO (se référer au bulletin éditeur cisco-sa-webex-cui-cert-8jSZYhWL pour plus de détails)
Cisco	Identity Services Engine	ISE et ISE-PIC version 3.5 sans le correctif de sécurité Patch 3

References

Title

Publication Time

CISCO-SA-WEBEX-CUI-CERT-8JSZYHWL

Vulnerability from csaf_cisco - Published: 2026-04-15 16:00 - Updated: 2026-04-16 18:52

Summary

Cisco Webex Services Certificate Validation Vulnerability

Scope

1 vulnerability in this advisory, including CVE-2026-20184.

CVE-2026-20184

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

https://software.cisco.com

Open the full advisory

FKIE_CVE-2026-20184

Vulnerability from fkie_nvd - Published: 2026-04-15 17:17 - Updated: 2026-10-26 22:10

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Webex Meetings",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "39.7.7"
            },
            {
              "status": "affected",
              "version": "39.9"
            },
            {
              "status": "affected",
              "version": "40.4.10"
            },
            {
              "status": "affected",
              "version": "39.6"
            },
            {
              "status": "affected",
              "version": "40.6.2"
            },
            {
              "status": "affected",
              "version": "39.8.2"
            },
            {
              "status": "affected",
              "version": "39.8.4"
            },
            {
              "status": "affected",
              "version": "40.1"
            },
            {
              "status": "affected",
              "version": "39.11"
            },
            {
              "status": "affected",
              "version": "39.7.4"
            },
            {
              "status": "affected",
              "version": "39.9.1"
            },
            {
              "status": "affected",
              "version": "40.4"
            },
            {
              "status": "affected",
              "version": "40.6"
            },
            {
              "status": "affected",
              "version": "39.7"
            },
            {
              "status": "affected",
              "version": "39.8"
            },
            {
              "status": "affected",
              "version": "39.8.3"
            },
            {
              "status": "affected",
              "version": "40.2"
            },
            {
              "status": "affected",
              "version": "39.10"
            },
            {
              "status": "affected",
              "version": "42.6"
            },
            {
              "status": "affected",
              "version": "42.7"
            },
            {
              "status": "affected",
              "version": "42.8"
            },
            {
              "status": "affected",
              "version": "42.9"
            },
            {
              "status": "affected",
              "version": "42.10"
            },
            {
              "status": "affected",
              "version": "42.11"
            },
            {
              "status": "affected",
              "version": "42.12"
            },
            {
              "status": "affected",
              "version": "43.1"
            },
            {
              "status": "affected",
              "version": "43.2"
            },
            {
              "status": "affected",
              "version": "43.3"
            },
            {
              "status": "affected",
              "version": "43.4"
            },
            {
              "status": "affected",
              "version": "43.4.1"
            },
            {
              "status": "affected",
              "version": "43.4.2"
            },
            {
              "status": "affected",
              "version": "43.5.0"
            },
            {
              "status": "affected",
              "version": "43.6.0"
            },
            {
              "status": "affected",
              "version": "43.6.1"
            },
            {
              "status": "affected",
              "version": "43.7"
            },
            {
              "status": "affected",
              "version": "43.8"
            },
            {
              "status": "affected",
              "version": "43.9"
            },
            {
              "status": "affected",
              "version": "43.10"
            },
            {
              "status": "affected",
              "version": "43.11"
            },
            {
              "status": "affected",
              "version": "43.12"
            },
            {
              "status": "affected",
              "version": "44.1"
            },
            {
              "status": "affected",
              "version": "44.2"
            },
            {
              "status": "affected",
              "version": "44.3"
            },
            {
              "status": "affected",
              "version": "44.4"
            },
            {
              "status": "affected",
              "version": "44.5"
            },
            {
              "status": "affected",
              "version": "44.6"
            },
            {
              "status": "affected",
              "version": "44.7"
            },
            {
              "status": "affected",
              "version": "44.8"
            },
            {
              "status": "affected",
              "version": "44.9"
            },
            {
              "status": "affected",
              "version": "44.10"
            },
            {
              "status": "affected",
              "version": "44.11"
            },
            {
              "status": "affected",
              "version": "44.12"
            },
            {
              "status": "affected",
              "version": "45.1"
            },
            {
              "status": "affected",
              "version": "45.2"
            },
            {
              "status": "affected",
              "version": "45.3"
            },
            {
              "status": "affected",
              "version": "45.4"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.\r\n\r\nThis vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la integraci\u00f3n de inicio de sesi\u00f3n \u00fanico (SSO) con Control Hub en los servicios de Cisco Webex podr\u00eda haber permitido a un atacante remoto no autenticado suplantar a cualquier usuario dentro del servicio.\n\nEsta vulnerabilidad exist\u00eda debido a una validaci\u00f3n de certificado incorrecta. Antes de que esta vulnerabilidad fuera abordada, un atacante podr\u00eda haber explotado esta vulnerabilidad conect\u00e1ndose a un punto final de servicio y proporcionando un token manipulado. Un exploit exitoso podr\u00eda haber permitido al atacante obtener acceso no autorizado a servicios leg\u00edtimos de Cisco Webex."
    }
  ],
  "id": "CVE-2026-20184",
  "lastModified": "2026-10-26T22:10:00.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20184",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-15T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-15T17:17:03.677",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HH5G-G7M5-5VXV

Vulnerability from github – Published: 2026-04-15 18:31 – Updated: 2026-04-15 18:31

Details

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.

This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20184"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-15T17:17:03Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.\n\nThis vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.",
  "id": "GHSA-hh5g-g7m5-5vxv",
  "modified": "2026-04-15T18:31:58Z",
  "published": "2026-04-15T18:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20184"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0122

Vulnerability from csaf_ncscnl - Published: 2026-04-17 08:37 - Updated: 2026-04-17 08:37

Summary

Kwetsbaarheid verholpen in Cisco Webex Services

Scope

1 vulnerability in this advisory, including CVE-2026-20184.

CVE-2026-20184

A vulnerability in Cisco Webex Services' SSO integration with Control Hub due to improper certificate validation could allow an unauthenticated remote attacker to impersonate any user and gain unauthorized access.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 3 products

Open the full advisory

WID-SEC-W-2026-1132

Vulnerability from csaf_certbund - Published: 2026-04-15 22:00 - Updated: 2026-04-15 22:00

Summary

Cisco WebEx: Mehrere Schwachstellen

Severity

Hoch

Scope

2 vulnerabilities in this advisory, including CVE-2026-20184.

CVE-2026-20184

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-20184 (GCVE-0-2026-20184)

BDU:2026-05532 (CVE-2026-20184)

CERTFR-2026-AVI-0451

Solutions

CISCO-SA-WEBEX-CUI-CERT-8JSZYHWL

FKIE_CVE-2026-20184

GHSA-HH5G-G7M5-5VXV

NCSC-2026-0122

WID-SEC-W-2026-1132

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour