What is the CVSS score of CVE-2026-20119?

CVE-2026-20119 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cisco are affected by CVE-2026-20119?

Cisco TelePresence and RoomOS devices are vulnerable to remote denial-of-service attacks that could disrupt video conferencing infrastructure without requiring user authentication.

How to fix or mitigate CVE-2026-20119?

Within 24 hours: Identify and inventory all Cisco TelePresence CE and RoomOS endpoints in your environment; assess network exposure and determine which devices face untrusted networks. Within 7 days: Implement network segmentation and access controls to restrict connectivity to collaboration endpoints; prioritize isolation of internet-facing devices. Within 30 days: Monitor Cisco security advisories for patch availability; establish a change management process for rapid deployment once patches are released; consider vendor communication regarding mitigation timelines.

Cisco CVE-2026-20119

HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-02-04 psirt@cisco.com

Cisco Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 04, 2026 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to insufficient validation of input received by an affected device. An attacker could exploit this vulnerability by getting the affected device to render crafted text, for example, a crafted meeting invitation. As indicated in the CVSS score, no user interaction is required, such as accepting the meeting invitation. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

AnalysisAI

Unauthenticated remote attackers can crash Cisco TelePresence Collaboration Endpoint and RoomOS devices by sending specially crafted text through meeting invitations or similar channels, exploiting insufficient input validation in the text rendering subsystem. The vulnerability requires no user interaction and causes device reloads resulting in denial of service. No patch is currently available.

Technical ContextAI

in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.