Cisco TS Agent CVE-2026-20028

Exploitation requires the attacker to hold at least user-level credentials on the system running Cisco TS Agent - unauthenticated exploitation is not possible per the CVSS PR:L metric. The vulnerable component must be an actively running Cisco TS Agent instance (versions TSAgent-1.0 through TSAgent-1.4.2) integrated into a Cisco ISE or firewall-policy enforcement architecture where per-user firewall rules are enforced by the agent. The attacker must be able to send crafted network traffic to the affected device from a network-accessible position (AV:N). Exploitation is limited by the requirement for valid credentials; organizations with no Terminal Services infrastructure or those not using Cisco TS Agent for per-user policy enforcement are not affected. The practical impact is also bounded by the permissiveness delta between the attacker's own firewall rules and the inherited victim user's rules - if all users have equivalent policies, exploitation yields no meaningful advantage.

The CVSS base score of 5.0 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N accurately reflects a moderate, low-complexity network exploitation requiring only user-level credentials. The scope change (S:C) is the most notable signal: successful exploitation does not merely bypass the attacker's own controls but allows them to assume the firewall posture of another user, potentially a more privileged one with broader network access. No EPSS data is available in the provided intelligence, no POC code has been identified, and the vulnerability is absent from the CISA KEV catalog - all signals indicating no confirmed or widespread exploitation activity. Real-world impact depends heavily on what the inherited user's firewall policy unlocks; in tightly segmented ISE deployments, this could enable lateral movement to otherwise inaccessible network segments. In loosely segmented environments the incremental value to an attacker is limited. SSVC assessment: exploitation status is 'none', automatable is 'yes' given AC:L and no UI, technical impact is 'partial' (integrity only, no confidentiality or availability). Priority is moderate for organizations running Cisco ISE with TS Agent in high-segmentation environments.

A low-privileged user authenticated to a Windows Terminal Services host running the affected TS Agent sends specially crafted network traffic designed to trigger the agent's incorrect user-to-connection mapping logic. The agent associates the attacker's connection with a different, more permissive user account and applies that user's firewall rule-set, allowing the attacker to reach network segments or hosts that their own policy would have blocked. No public proof-of-concept code is known at time of analysis, but the low attack complexity suggests any attacker with valid credentials and knowledge of the mapping flaw could replicate this without significant tooling.