What is the CVSS score of CVE-2026-20150?

CVE-2026-20150 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Cisco RoomOS are affected by CVE-2026-20150?

Cisco RoomOS collaboration endpoints contain a privilege escalation vulnerability (CVE-2026-20150, CVSS 8.8) that enables authenticated users to gain full administrative control over affected…

How to fix or mitigate CVE-2026-20150?

Within 24 hours, conduct a complete inventory of all Cisco RoomOS devices in your environment and implement network segmentation restricting administrative access to authorized personnel only, using firewall rules and VLANs to isolate management functions. Within 7 days, deploy enhanced logging and real-time alerting for privilege escalation attempts on RoomOS endpoints; review and minimize accounts with low-level privileges that could be exploited for escalation; and enforce multi-factor authentication for all administrative access to RoomOS management interfaces. Within 30 days, establish continuous monitoring of Cisco security advisories for patch availability; contact your Cisco Technical Account Manager to confirm the hardening release timeline; and pre-stage deployment procedures in your patch management workflow to enable immediate implementation upon vendor release.

Cisco RoomOS CVE-2026-20150

EUVD-2026-44715 HIGH

Improper Access Control (CWE-284)

2026-07-15 cisco

GHSA-f3fw-7mc3-5vg7

Authentication Bypass Cisco Cisco Roomos Software

8.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable management interface (AV:N/AC:L), but a valid low-privilege authenticated session is required (PR:L); access-control bypass yields full device compromise, hence C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 16:45 vuln.today

CVE Published

Jul 15, 2026 - 16:17 cve.org

HIGH 8.8

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20150 are related to improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

AnalysisAI

Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-level privileges to gain full control over affected collaboration endpoints, with high impact to confidentiality, integrity, and availability. The issue was discovered internally by Cisco's RoomOS engineering team during a proactive security review and is one of several access-control weaknesses grouped under CVE-2026-20150 and resolved in a single hardening release. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Cisco RoomOS is the operating system that powers Cisco's video collaboration and Webex Room/Board/Desk endpoints, controlling device configuration, media handling, and administrative APIs. The vulnerability class is CWE-284 (Improper Access Control), the CISA/MITRE pillar weakness covering cases where the software fails to correctly restrict which authenticated actors can access resources or perform privileged operations. The Cisco tags label this as an Authentication Bypass, indicating the access-control gap likely lets a lower-privileged authenticated session reach functionality or resources intended only for higher-privileged roles. Per the advisory, multiple distinct internally-discovered access-control defects were grouped under this single CVE, so the exact affected subsystem (API, web management, local service) is not disaggregated in the available data.

RemediationAI

Patch available per vendor advisory: upgrade affected Cisco RoomOS endpoints to the hardened software release described in Cisco Security Advisory cisco-sa-hardening-roomos-AqNMbEq (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq); the exact fixed version string is not provided in the available data and should be taken directly from that advisory or the device's Webex Control Hub update channel. Because exploitation requires an authenticated low-privilege foothold, effective compensating controls until patching include restricting who holds local device and administrative accounts, enforcing strong unique credentials and disabling default/shared accounts, and placing RoomOS endpoints on a segmented management VLAN with network ACLs that limit reachability of device management interfaces to trusted administrator hosts only - the trade-off is added operational overhead for legitimate admins and provisioning tools. Avoid exposing device web/API management interfaces to general user or guest networks. These controls reduce the pool of potential authenticated attackers but do not eliminate the flaw, so patching remains the durable fix.