CVE-2026-20153

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20153 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco RoomOS SoftwareRoomOS 10.11.2.2; RoomOS 10.15.2.2; RoomOS 11.5.4.6; RoomOS 11.5.2.4; RoomOS 10.8.2.5; RoomOS 10.11.5.2; RoomOS 10.11.3.0; RoomOS 10.15.5.3; RoomOS 10.19.2.2; RoomOS 11.1.3.1; RoomOS 10.11.6.0; RoomOS 10.19.3.0; RoomOS 10.19.4.2; RoomOS 10.3.2.4; RoomOS 10.3.4.0; RoomOS 10.15.3.0; RoomOS 11.1.4.1; RoomOS 11.14.2.3; RoomOS 11.1.2.4; RoomOS 10.8.3.1

References

Timeline

Published
Jul 15, 2026
Last modified
Oct 24, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-201548.6A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) SofCVE-2026-201558.0A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remCVE-2026-201569.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehenCVE-2026-201579.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehenCVE-2026-201587.5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehenCVE-2026-20167.8A security vulnerability has been detected in happyfish100 libfastcommon up to 1.0.84. Affected by this vulnerability is the function base64CVE-2026-201609.8A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary cCVE-2026-201615.5A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrCVE-2026-201626.3In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9, and Splunk Cloud Platform versions below 10.2.2510.4, 10.1.2507.15, 10CVE-2026-201637.2In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 1CVE-2026-201646.5In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 1CVE-2026-201656.5In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 1
CVE-2026-20153: High severity, CVSS 7.5 | Vulnix