What is the CVSS score of CVE-2026-20158?

CVE-2026-20158 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Cisco Roomos Software are affected by CVE-2026-20158?

Cisco RoomOS contains a remote denial of service vulnerability (CVSS 7.5) allowing attackers to exhaust or corrupt resources on collaboration room endpoints, degrading availability.

How to fix or mitigate CVE-2026-20158?

Within 24 hours: Identify and inventory all Cisco RoomOS deployments, document current firmware versions and network exposure. Within 7 days: Implement compensating controls including network segmentation to restrict endpoint exposure, enable rate limiting and anomaly monitoring for resource consumption, and apply access controls limiting management connectivity to trusted networks. Within 30 days: Continuously monitor Cisco security advisories for patch availability and prepare rapid deployment procedures; evaluate temporary operational restrictions to non-essential network services on affected endpoints pending vendor patch release.

Cisco Roomos Software CVE-2026-20158

EUVD-2026-44721 HIGH

Improper Control of a Resource Through its Lifetime (CWE-664)

2026-07-15 cisco

GHSA-w7f5-hxx8-wf55

Cisco Information Disclosure Cisco Roomos Software

7.5

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (cisco) · only source for this CVE.

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 16:49 vuln.today

CVE Published

Jul 15, 2026 - 16:18 cve.org

HIGH 7.5

DescriptionCVE.org

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20158 are related to improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

AnalysisAI

Remote denial of service in Cisco RoomOS software allows unauthenticated attackers to exhaust or corrupt a resource over the network, disrupting availability of Cisco collaboration room endpoints. Disclosed as part of a Cisco-internal security hardening review under the CWE-664 resource-lifetime pillar, the flaw carries a 7.5 CVSS score with an availability-only impact (C:N/I:N/A:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.