CVE-2025-20291: Cisco Webex Meetings · Open Redirect
Affects Cisco Webex MeetingsSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 11:42 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Although Cisco has remediated this vulnerability on the server side, European organizations should implement additional mitigations to reduce risk. First, conduct targeted user awareness training focusing on recognizing suspicious URLs and the risks of clicking unknown links, especially in meeting invitations. Second, deploy email security solutions with URL rewriting and sandboxing capabilities to detect and block malicious links before they reach users. Third, implement web filtering solutions that can block access to known malicious domains or suspicious redirectors. Fourth, encourage the use of multi-factor authentication (MFA) on Webex accounts to reduce the impact of credential theft. Fifth, monitor Webex meeting join URLs in internal communications for anomalies or unexpected redirects. Finally, maintain up-to-date threat intelligence feeds to identify emerging phishing campaigns exploiting this vulnerability.
Description
A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted website. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. This vulnerability existed because of insufficient validation of URLs that were included in a meeting-join URL. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by including a URL to a website of their choosing in a specific value of a Cisco Webex Meetings join URL. A successful exploit could have allowed the attacker to redirect a targeted user to a website that was controlled by the attacker, possibly making the user more likely to believe the website was trusted by Webex and perform additional actions as part of phishing attacks.