Privilege Escalation Vulnerability in Cisco IOS XE Lobby Ambassador API

CVE-2026-20114

What is CVE-2026-20114?

A privilege escalation vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software allows an authenticated remote attacker to gain access to management APIs not typically available to Lobby Ambassador users. This weakness arises from insufficient validation of parameters received by an API endpoint. By authenticating as a Lobby Ambassador user and crafting a specific HTTP request, the attacker could exploit this vulnerability to create a new user with access privileges to the management API. Consequently, the attacker could then access the affected device using these new credentials, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References