EUVD-2026-53447
GHSA-6vj9-8q5m-xjpv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Network vector confirmed; PR:L because user credentials required; S:C because attacker inherits another user's policy boundary; no confidentiality or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker.
This vulnerability is due to an incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials could exploit this vulnerability by sending crafted network traffic to an affected device. A successful exploit could allow the attacker to inherit the firewall rules associated with a different user in the system.
AnalysisAI
Firewall rule inheritance bypass in Cisco Terminal Services (TS) Agent allows an authenticated remote attacker to escape their own firewall policy and operate under the network access rules of a different user account. Affected versions span TSAgent-1.0 through TSAgent-1.4.2 per EUVD-2026-53447. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at least user-level credentials on the system running Cisco TS Agent - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.0 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N accurately reflects a moderate, low-complexity network exploitation requiring only user-level credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrev for the vendor-released fixed version - no exact patch version was present in the available intelligence data and one should not be inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today