What is the CVSS score of CVE-2026-20157?

CVE-2026-20157 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cisco RoomOS are affected by CVE-2026-20157?

Cisco RoomOS, the operating system for Webex and room collaboration endpoints, contains critical encryption weaknesses (CVE-2026-20157, CVSS 9.8) that could enable attackers to intercept sensitive…

How to fix or mitigate CVE-2026-20157?

Immediate action (within 24 hours): Conduct a comprehensive inventory of all Cisco RoomOS devices (Webex Room Systems, room endpoints, and collaboration appliances), document their software versions and network locations, and begin collecting network traffic baselines. Near-term (within 7 days): Isolate RoomOS devices on dedicated network segments with restrictive firewall rules permitting only essential management and service traffic, implement enhanced logging on network appliances to detect suspicious data flows from room devices, and enforce TLS 1.3 or higher for all management communications. Medium-term (within 30 days): Subscribe to Cisco's RoomOS security advisory channel, develop a testing and deployment plan for security updates when available, and formally document this vulnerability in your risk register with remediation timelines tied to Cisco's patch release date.

Cisco RoomOS CVE-2026-20157

EUVD-2026-44718 CRITICAL

Missing Encryption of Sensitive Data (CWE-311)

2026-07-15 cisco

GHSA-c7x8-7666-3x3f

Cisco Information Disclosure Cisco Roomos Software

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (cisco) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Missing encryption requires an on-path/MITM position to intercept data (AC:H), yielding high confidentiality exposure but only limited integrity via tampering and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cisco).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 14:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 14:37 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 14:37 NVD

HIGH CRITICAL

CVSS changed

Aug 11, 2026 - 14:37 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 15, 2026 - 16:47 vuln.today

CVE Published

Jul 15, 2026 - 16:18 cve.org

HIGH 7.5

DescriptionNVD

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20157 are related to missing encryption that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-311.

AnalysisAI

Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed in an internal-hardening release covering multiple internally discovered issues grouped under CWE-311. Because sensitive data or communications are not adequately encrypted, network-positioned attackers could intercept or expose information handled by affected devices. There is no public exploit identified at time of analysis and this CVE is not in CISA KEV; EPSS is negligible at 0.06% (0th percentile), consistent with SSVC 'Exploitation: none.' Note the published CVSS 9.8 (C:H/I:H/A:H) sits uneasily against a CWE-311/Information-Disclosure classification, which normally implies a confidentiality-centric impact.

Technical ContextAI

RoomOS is the embedded operating system running on Cisco collaboration endpoints (Webex Room/Desk/Board series and related video devices). The affected component is identified by CPE cpe:2.3:a:cisco:cisco_roomos_software and the tag set flags this as Information Disclosure. The root-cause class is CWE-311 (Missing Encryption of Sensitive Data) - Cisco cites the CWE-311 Pillar, indicating one or more weaknesses where data at rest or in transit is stored or transmitted without adequate cryptographic protection. Cisco disclosed this as part of a proactive, internally driven security-hardening release rather than in response to external reporting, so per-issue technical detail (which data, which channel, cleartext vs. weak cipher) is not individually enumerated in the advisory.

RemediationAI

Upgrade to a Cisco RoomOS build that includes the hardening fixes as documented in Cisco advisory cisco-sa-hardening-roomos-AqNMbEq (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq); the advisory is the authoritative source for the exact patched version since this is a bundled hardening release and a single canonical fix version is not present in the provided data (Patch available per vendor advisory - released patched version not independently confirmed here). Many RoomOS/Webex endpoints are cloud-managed and updated automatically via Webex Control Hub, so confirm devices are on a current channel and not pinned to a static/on-premises build. As compensating controls until updated, place collaboration endpoints on a segmented management VLAN, restrict who can reach device management/API and signaling interfaces, and ensure transport encryption is enforced at the network layer (e.g., require TLS/SRTP on call control where configurable) to reduce exposure of any cleartext data - with the trade-off that segmentation and stricter ACLs can disrupt provisioning, monitoring, or interoperability if calling/management flows are not accounted for.