Product:
Webex
Summary
A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. This vulnerability was due to improper filtering of user-supplied input. An attacker could have exploited this vulnerability by persuading a user to follow a malicious link, leading to potential XSS attacks against the targeted user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2026-20149 |
Exploitation
To exploit this vulnerability, an attacker would need to convince a user to click on a specially crafted link. Once the user follows the link, the attacker could execute malicious scripts in the context of the user’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- Webex: Affected by the XSS vulnerability due to improper input filtering.
Mitigation
Cisco has addressed this vulnerability, and no customer action is needed. Users are encouraged to ensure they are using the latest version of Webex to benefit from the security improvements.