Threat Intelligence Database

CVE-2026-20233 is a cross-site scripting (XSS) vulnerability in the web-based user interface of Cisco Webex Meetings. It allows an unauthenticated remote attacker to execute arbitrary script code in a user's browser by persuading the user to follow a malicious link. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.

A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect quiz and poll results. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed. This vulnerability existed because of the presence of an insecure direct object reference. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by sending a crafted request to the vulnerable API endpoint. A successful exploit could have allowed the attacker to view the social profiles of other users or affect quiz and poll results.

CVE-2026-20184 is a critical vulnerability in Cisco Webex Meetings involving improper certificate validation in the single sign-on (SSO) integration with Control Hub. This flaw could allow an unauthenticated remote attacker to impersonate any user by supplying a crafted token to a service endpoint, resulting in unauthorized access to Cisco Webex services. The vulnerability affects multiple versions of Cisco Webex Meetings as listed. The CVSS score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.