EUVD-2026-22965Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local attack vector, low privileges, low complexity, and only integrity impact are reflected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device.
This vulnerability is due to improper access controls on files that are on the local file system of an affected device. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to bypass file system permissions and overwrite arbitrary files on the affected device.
AnalysisAI
Local file overwrite in Cisco ThousandEyes Enterprise Agent allows authenticated, low-privileged CLI users to overwrite arbitrary files by placing a symbolic link in a specific directory, achieving integrity compromise on the agent host. This vulnerability (CVE-2026-20161) has low exploitation probability (EPSS 0.01%) and is not listed in CISA KEV; no public exploit code is currently known.
Technical ContextAI
The vulnerability resides in the CLI component of the Cisco ThousandEyes Enterprise Agent, a network monitoring agent deployed on endpoints. Root cause is improper resolution of symbolic links before file write operations (CWE-59: Improper Link Resolution Before File Access). The agent's file system access controls fail to verify whether a target path is a symlink, allowing a crafted symlink in a specific writable location to redirect writes to arbitrary files outside the intended scope. The affected product is identified by CPE cpe:2.3:a:cisco:cisco_thousandeyes_enterprise_agent:*:*:*:*:*:*:*:*.
RemediationAI
Apply the vendor-released patch by upgrading to a fixed version of Cisco ThousandEyes Enterprise Agent as detailed in Cisco security advisory cisco-sa-te-agentfilewrite-tqUw3SMU. If immediate patching is not possible, restrict local user access to the agent’s CLI or remove write permissions from the directory used for symlink placement; note that this workaround may disrupt legitimate agent management tasks. Monitor Cisco’s advisory for the most current mitigation guidance.
Command injection in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance lets an authenticated administ
Command injection in the BrowserBot component of Cisco ThousandEyes Enterprise Agent (CWE-78) allows authenticated SaaS
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today