How severe is CVE-2026-20149?

CVE-2026-20149 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-20149 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-20149?

CVE-2026-20149 affects Cisco Webex. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-20149?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-20149 have an EU (EUVD) identifier?

Yes. CVE-2026-20149 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9473.

When was CVE-2026-20149 published?

CVE-2026-20149 was published on 2026-03-04 and last updated on 2026-06-17.

CVE-2026-20149

CVE-2026-20149 is a medium-severity vulnerability in Cisco Webex with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9473
Weakness: CWE-79
Affected product: Cisco Webex
Published: 2026-03-04
Last modified: 2026-06-17

Description

A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed. This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.

Frequently asked questions

What is CVE-2026-20149?: A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed. This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.
How severe is CVE-2026-20149?: CVE-2026-20149 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-20149 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-20149?: CVE-2026-20149 affects Cisco Webex. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-20149?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-20149 have an EU (EUVD) identifier?: Yes. CVE-2026-20149 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9473.
When was CVE-2026-20149 published?: CVE-2026-20149 was published on 2026-03-04 and last updated on 2026-06-17.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-TZFTbbwN

Affected products (1)

cpe:2.3:a:cisco:webex:-:*:*:*:*:*:*:*

More vulnerabilities in Cisco Webex

CVE-2009-2880 — Critical (CVSS 9.3): Buffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for…
CVE-2009-2879 — Critical (CVSS 9.3): Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for…
CVE-2009-2878 — Critical (CVSS 9.3): Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for…
CVE-2009-2877 — Critical (CVSS 9.3): Stack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before…
CVE-2009-2876 — Critical (CVSS 9.3): Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for…
CVE-2009-2875 — Critical (CVSS 9.3): Buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for…

All CVEs affecting Cisco Webex →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →