Remote Code Execution Vulnerability in Cisco Meeting Management
CVE-2026-20098

8.8HIGH

Key Information:

Vendor

Cisco
Status
Cisco Meeting Management
Vendor
CVE Published:
4 February 2026

Badges

👾 Exploit Exists

What is CVE-2026-20098?

A security flaw exists in the Certificate Management component of Cisco Meeting Management, enabling authenticated remote attackers to exploit improper input validation in the web-based management interface. By sending specially crafted HTTP requests, an attacker with valid user credentials (at least video operator level) may upload arbitrary files to the system. This could lead to overwriting critical system files and executing arbitrary commands with root privileges, thereby compromising the entire system.

Affected Version(s)

Cisco Meeting Management CMM3.4.0

Cisco Meeting Management CMM3.2.0

Cisco Meeting Management CMM2.9.1

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.