Cyber Posture

CVE-2026-20098

High

Published: 04 February 2026

Published
04 February 2026
Modified
10 March 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0072 72.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input…

more

validation in certain sections of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload arbitrary files to the affected system. The malicious files could overwrite system files that are processed by the root system account and allow arbitrary command execution with root privileges. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of video operator.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the core issue of improper input validation in the web-based management interface, preventing crafted HTTP requests that enable arbitrary file uploads.

SI-2 Flaw Remediation good match
prevent

Mitigates the vulnerability through timely flaw remediation, including application of the vendor-provided patch referenced in the Cisco Security Advisory.

AC-6 Least Privilege partial match
prevent

Reduces privilege escalation risk by enforcing least privilege for the video operator role, limiting the ability to overwrite root-processed system files.

Security SummaryAI

CVE-2026-20098 is a vulnerability in the Certificate Management feature of Cisco Meeting Management. The issue arises from improper input validation in certain sections of the web-based management interface, which could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system.

An attacker must have valid credentials for a user account with at least the video operator role to exploit this vulnerability. By sending a crafted HTTP request to an affected system, the attacker can upload arbitrary files that overwrite system files processed by the root system account, enabling arbitrary command execution with root privileges. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

The Cisco Security Advisory provides details on mitigation and available patches at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-file-up-kY47n8kK.

Details

CWE(s)
CWE-434

Affected Products

cisco
meeting management
≤ 3.12.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Vulnerability in web-based management interface enables authenticated remote file upload overwriting system files for root RCE, directly mapping to public-facing app exploitation (T1190), privilege escalation via exploitation (T1068), and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References