This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 5 vulnerabilities

Cisco fixes 5 vulnerabilities in various products. The most severe vulnerabilities are described below; the rest can be found at [1]. Individual products and their fixed versions: Cisco Meeting Management - 3.12.1 MR [2] Cisco TelePresence CE Software, RoomOS Software - On-Premise: 11.27.5.0, 11.32.3.0 [3] - Cloud-Aware: RoomOS October 2025, RoomOS December 2025 [3] Cisco Prime Infrastructure - 3.10.6 Security Update 02 [4][5] Cisco Evolved Programmable Network Manager - 8.1.1 [5] Cisco Secure Web Appliance - 15.2.5-011 [6]

Cisco Meeting Management - arbitrary file upload (CVE-2026-20098)
CVSS 8.8 (High)

Due to insufficient input validation in the certificate management web interface of Cisco Meeting Management, an authenticated remote attacker can upload arbitrary files by sending a specially crafted HTTP request, overwrite system files, and thereby execute commands and escalate privileges to root. The attacker must have valid credentials with at least the Video Operator role [2].

The vulnerability is present in product:

  • Cisco Meeting Management; >=3.12, <3.12.1 MR

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 4. 2. 2026.

Cisco TelePresence Collaboration Endpoint Software, RoomOS Software - DoS (CVE-2026-20119)
CVSS 7.5 (High)

Due to insufficient input validation in the text rendering subsystem of Cisco TelePresence CE and Cisco RoomOS, an unauthenticated remote attacker can use specially crafted text to cause the device to restart and thus trigger a denial of service (DoS), without any user interaction [3].

The vulnerability is present in products:

  • Cisco TelePresence CE Software;
  • Cisco RoomOS Software;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 4. 2. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 5. 2. 2026.

CESNET, z.s.p.o. Logo