EUVD-2026-44718
GHSA-c7x8-7666-3x3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain on-path network position near endpoint
-
ExploitIntercept RoomOS traffic or access stored data
-
ExecutionExploit missing/weak encryption
-
ImpactRecover sensitive cleartext information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encryption of sensitive data
|
| Exploitation Conditions | The vulnerability class (CWE-311, missing encryption / information disclosure) means exploitation hinges on an attacker being able to access the unencrypted data - in practice a network intercept or MITM position relative to the RoomOS endpoint, or access to where the unencrypted data is stored/transmitted. Cisco's advisory does not enumerate the specific feature, channel, or configuration for each grouped issue, so the exact trigger is not fully specified in available data. Limiting factors: exploitation is not automatable (SSVC Automatable: no), there is no observed exploitation (SSVC Exploitation: none), EPSS is 0.06%, and realistic attacks require an on-path/network vantage point rather than default remote unauthenticated reachability - despite the CVSS vector reading AV:N/AC:L/PR:N/UI:N, which should be verified against the missing-encryption root cause. |
| Impact | The signals conflict and should be reconciled before prioritization. The published CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, which on its face implies trivial remote unauthenticated total compromise. However, the CWE (CWE-311, missing encryption) and the 'Information Disclosure' tag point to a confidentiality-oriented data-exposure flaw, for which AC:L and A:H are questionable - exploiting missing encryption typically requires a privileged network/MITM position to intercept traffic, which is closer to AC:H, and rarely affects availability. Supporting a lower real-world urgency: EPSS is 0.06% (0th percentile), SSVC reports Exploitation 'none' and Automatable 'no', there is no KEV listing, and no public PoC. Technical Impact is rated 'total,' which is the only strong-severity corroborant. Net: treat this as a genuine but likely lower-urgency hardening fix - patch on a normal cadence rather than emergency-out-of-band, and verify the true attack vector/impact with Cisco, as the 9.8 score appears inflated relative to the missing-encryption root cause. |
| Exploit ScenarioDerived | An attacker who can observe or intercept network traffic to or from a Cisco RoomOS endpoint (for example on a shared LAN segment, a compromised switch, or a MITM position) captures sensitive data that the device transmits or stores without adequate encryption. No public exploit code exists, and success depends on gaining that privileged network vantage point rather than sending a single remote unauthenticated request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 11, 2026
Missing-encryption weaknesses in Cisco RoomOS software (the OS for Cisco Webex/Room collaboration endpoints) were fixed in an internal-hardening release covering multiple internally discovered issues grouped under CWE-311. Because sensitive data or communications are not adequately encrypted, network-positioned attackers could intercept or expose information handled by affected devices. There is no public exploit identified at time of analysis and this CVE is not in CISA KEV; EPSS is negligible at 0.06% (0th percentile), consistent with SSVC 'Exploitation: none.' Note the published CVSS 9.8 (C:H/I:H/A:H) sits uneasily against a CWE-311/Information-Disclosure classification, which normally implies a confidentiality-centric impact.
Earlier versions of this analysis (1)
Sensitive information disclosure affects Cisco RoomOS software running on Cisco collaboration room endpoints, where missing encryption (CWE-311) exposes data to an attacker positioned on the adjacent network. An adjacent, unauthenticated attacker who can intercept or manipulate traffic could access confidential information and potentially tamper with it, though successful exploitation carries high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was internally discovered by Cisco's RoomOS engineering team during a proactive hardening review.
RemediationAI
Upgrade to a Cisco RoomOS build that includes the hardening fixes as documented in Cisco advisory cisco-sa-hardening-roomos-AqNMbEq (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq); the advisory is the authoritative source for the exact patched version since this is a bundled hardening release and a single canonical fix version is not present in the provided data (Patch available per vendor advisory - released patched version not independently confirmed here). Many RoomOS/Webex endpoints are cloud-managed and updated automatically via Webex Control Hub, so confirm devices are on a current channel and not pinned to a static/on-premises build. As compensating controls until updated, place collaboration endpoints on a segmented management VLAN, restrict who can reach device management/API and signaling interfaces, and ensure transport encryption is enforced at the network layer (e.g., require TLS/SRTP on call control where configurable) to reduce exposure of any cleartext data - with the trade-off that segmentation and stricter ACLs can disrupt provisioning, monitoring, or interoperability if calling/management flows are not accounted for.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RoomOS is the embedded operating system running on Cisco collaboration endpoints (Webex Room/Desk/Board series and related video devices). The affected component is identified by CPE cpe:2.3:a:cisco:cisco_roomos_software and the tag set flags this as Information Disclosure. The root-cause class is CWE-311 (Missing Encryption of Sensitive Data) - Cisco cites the CWE-311 Pillar, indicating one or more weaknesses where data at rest or in transit is stored or transmitted without adequate cryptographic protection. Cisco disclosed this as part of a proactive, internally driven security-hardening release rather than in response to external reporting, so per-issue technical detail (which data, which channel, cleartext vs. weak cipher) is not individually enumerated in the advisory.
Know when Cisco Roomos Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing encryption requires an on-path/MITM position to intercept data (AC:H), yielding high confidentiality exposure but only limited integrity via tampering and no availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20157 are related to missing encryption that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-311.
Executive ViewAI
Cisco RoomOS, the operating system for Webex and room collaboration endpoints, contains critical encryption weaknesses (CVE-2026-20157, CVSS 9.8) that could enable attackers to intercept sensitive business communications in transit. No public exploit identified at time of analysis, and no vendor-released patch is currently available, but the threat to meeting confidentiality and data security across your collaboration infrastructure warrants immediate mitigation. Organizations must prioritize network isolation and monitoring controls for affected devices while tracking Cisco's advisory timeline for security updates.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation-isolate RoomOS devices on dedicated VLANs with strict egress filtering to block data exfiltration; (2) Access controls-restrict administrative access and disable unnecessary network services on affected devices; (3) Encryption enforcement-mandate TLS 1.3+ for all management connections and implement certificate pinning where supported; (4) Network monitoring-deploy data loss prevention (DLP) and network behavioral analysis to detect anomalous data transfers from room collaboration endpoints; (5) Vendor coordination-contact Cisco for emergency mitigations, configuration hardening, or accelerated patch timelines; (6) Operational alternatives-route meetings containing highly sensitive intellectual property through validated alternative communication channels until patches are available and deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Cisco Roomos Software
View allMemory-corruption vulnerabilities in Cisco RoomOS Software, disclosed by Cisco as a bundled hardening release from an in
Privilege escalation via improper access control in Cisco RoomOS software allows an authenticated attacker with low-leve
Denial of service in Cisco RoomOS software allows remote unauthenticated attackers to exhaust availability of affected c
Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over
Denial of service in Cisco RoomOS software allows remote, unauthenticated attackers to disrupt device availability throu
Credential exposure in Cisco RoomOS allows an authenticated low-privilege local user to capture user login credentials b
Root-level code execution in Cisco RoomOS via the USB driver allows an unauthenticated attacker with physical access to
Exploit-DB