Riskcovery

CVE-2026-20184

Cisco Webex Meetings Certificate Validation Vulnerability

State
Published
Severity
9.8 Critical
Published
Apr 15, 2026
Updated
Apr 16, 2026
Reserved
Oct 8, 2025

Read the record on cve.org

Description

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.

This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpoint and supplying a crafted token. A successful exploit could have allowed the attacker to gain unauthorized access to legitimate Cisco Webex services.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hcisco

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
Cisco Webex MeetingsCisco
  • 39.7.7Affected
  • 39.9Affected
  • 40.4.10Affected
  • 39.6Affected
  • 40.6.2Affected
  • 39.8.2Affected
  • 39.8.4Affected
  • 40.1Affected
  • 39.11Affected
  • 39.7.4Affected
  • 39.9.1Affected
  • 40.4Affected
  • 40.6Affected
  • 39.7Affected
  • 39.8Affected
  • 39.8.3Affected
  • 40.2Affected
  • 39.10Affected
  • 42.6Affected
  • 42.7Affected
  • 42.8Affected
  • 42.9Affected
  • 42.10Affected
  • 42.11Affected
  • 42.12Affected
  • and 31 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.