Cisco RoomOS CVE-2026-20156

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is remotely reachable over the network with low complexity, no authentication, and no user interaction against affected RoomOS builds - no special product feature toggle is documented as a precondition. The key limiting factor is network exposure: the attacker must be able to reach the vulnerable RoomOS service, so devices confined to a segmented/management-only network or behind firewalls are substantially harder to hit than internet- or flat-network-exposed endpoints. Cisco does not identify which specific parsing service is affected, so the practical reachable attack surface depends on the device's enabled services and network placement; exploitation is further limited by the absence of any public exploit and CISA SSVC's assessment of Automatable=no.

The signals are deliberately mixed and should temper the raw 9.8. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a worst-case network-reachable, unauthenticated, total-impact flaw, which is why the base score is critical. However, the exploitation-oriented signals all point downward: EPSS is only 0.23% (14th percentile), there is no public exploit identified, the vulnerability is not in CISA KEV, and CISA's SSVC decision framework records Exploitation=none and Automatable=no while confirming Technical Impact=total. This combination is typical of a vendor-self-disclosed hardening bundle: theoretically severe but with no evidence of real-world attack activity and no released exploit tooling. A caveat worth verifying: Cisco describes these as internally discovered issues grouped under a pillar CWE with no exploitation detail, so the AV:N/AC:L assignment is Cisco's assertion rather than something independently reproducible from the disclosure - for many RoomOS memory bugs, network reach depends on which service parses attacker-controlled input and whether the device is exposed beyond a trusted management network. Net priority: because RoomOS endpoints often sit on corporate networks and the impact is total device compromise, organizations running the listed versions should patch on a normal-to-expedited cycle, but this does not carry the emergency, actively-exploited urgency of a KEV-listed flaw.

An attacker with network reach to a Cisco RoomOS endpoint sends specially crafted input to a vulnerable network-facing service, triggering a buffer overflow that corrupts memory and, given the reported total (C:H/I:H/A:H) impact, could allow arbitrary code execution or a device crash. Because the CVSS vector indicates no authentication and no user interaction are required, exploitation would not depend on tricking a user, though no public exploit code is currently available.