CVE-2026-20187

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20187 are related to improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-703

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Cisco	Cisco RoomOS Software	RoomOS 10.11.2.2; RoomOS 10.15.2.2; RoomOS 11.5.4.6; RoomOS 11.5.2.4; RoomOS 10.8.2.5; RoomOS 10.11.5.2; RoomOS 10.11.3.0; RoomOS 10.15.5.3; RoomOS 10.19.2.2; RoomOS 11.1.3.1; RoomOS 10.11.6.0; RoomOS 10.19.3.0; RoomOS 10.19.4.2; RoomOS 10.3.2.4; RoomOS 10.3.4.0; RoomOS 10.15.3.0; RoomOS 11.1.4.1; RoomOS 11.14.2.3; RoomOS 11.1.2.4; RoomOS 10.8.3.1

References

Timeline

Published: Jul 15, 2026
Last modified: Oct 24, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-201880.0Following the initial publication of the Security Advisory about a denial of service (DoS) condition in Cisco Crosswork Network Controller a CVE-2026-201894.3A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to d CVE-2026-20197.2The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This CVE-2026-201907.5A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device CVE-2026-201917.5A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container CVE-2026-2019210.0As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass CVE-2026-201934.3A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administra CVE-2026-201949.1As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass CVE-2026-201955.3A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to enumerate valid user CVE-2026-201975.8Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote a CVE-2026-201984.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote a CVE-2026-201997.2A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to exe