What is the CVSS score of CVE-2026-20184?

CVE-2026-20184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Cisco Webex Meetings CVE-2026-20184

EUVD-2026-22971 CRITICAL

Improper Certificate Validation (CWE-295)

2026-04-15 cisco

Authentication Bypass Cisco Cisco Webex Meetings

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:27 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 16:30 euvd

EUVD-2026-22971

CVE Published

Apr 15, 2026 - 16:03 nvd

CRITICAL 9.8

DescriptionCVE.org

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.

This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.

AnalysisAI

Improper certificate validation in the SSO integration with Control Hub for Cisco Webex Services allowed unauthenticated remote attackers to impersonate any user by supplying a crafted token to a service endpoint. This authentication bypass enables full unauthorized access to Cisco Webex meetings, messaging, and related resources. While no active exploitation or public exploit code is known, the high severity and low attack complexity merit immediate attention.