← Vulnerability feed

Vulnerability record · CVE-2026-20149 · published 4 March 2026

CVE-2026-20149: Cisco webex cross-site scripting vulnerability

Cisco · Webex

A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed. This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.

6.1 CVSS 3.1 Medium EPSS 0.24% · top 87.0% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed. This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-TZFTbbwN Vendor Advisory

Track CVE-2026-20149 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2009-2875Cisco webex memory buffer overflow vulnerabilityBuffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 f…EPSS 5.1%9.3CVE-2009-2876Cisco webex memory buffer overflow vulnerabilityHeap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T…EPSS 5.1%9.3CVE-2009-2877Cisco webex memory buffer overflow vulnerabilityStack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x (aka T27SP10) for Wind…EPSS 5.1%9.3CVE-2009-2878Cisco webex memory buffer overflow vulnerabilityHeap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T…EPSS 5.1%9.3CVE-2009-2879Cisco webex memory buffer overflow vulnerabilityHeap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T…EPSS 5.1%9.3CVE-2009-2880Cisco webex memory buffer overflow vulnerabilityBuffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 f…EPSS 5.2%8.8CVE-2017-3823Cisco activetouch general plugin container memory buffer overflow vulnerabilityAn issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Fi…EPSS 27%5.8CVE-2012-6399Cisco webex improper input validation vulnerabilityCisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of th…EPSS 0.53%

Source: NIST National Vulnerability Database (record CVE-2026-20149), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.