CVE-2026-20092: Cisco Intersight Virtual Appliance Privilege Escalation Vulnerability
This Cisco advisory covers CVE-2026-20092. Related products: Cisco Intersight Virtual Appliance.
- CVE-2026-20092
Key facts
- Vendor rating
- Medium, CVSS 6
- CISA KEV
- Not listed (catalogue checked )
- Versions named
- Scope: This vulnerability affects Cisco Intersight Connected Virtual Appliance (CVA), which is cloud based.
- Advisory id
- cisco-sa-intersight-privesc-p6tBm6jk
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with administrative privileges to elevate privileges to root on the virtual appliance.
This vulnerability is due to improper file permissions on configuration files for system accounts within the maintenance shell of the virtual appliance. An attacker could exploit this vulnerability by accessing the maintenance shell as a read-only administrator and manipulating system files to grant root privileges.
A successful exploit could allow the attacker to elevate t…
Text from the source record.
- Scope: This vulnerability affects Cisco Intersight Connected Virtual Appliance (CVA), which is cloud based.
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-20092
Workaround status
- There are no workarounds that address this vulnerability.
More Cisco advisories
CVE-2026-76506Nov 4, 2026Cisco UCS Central Software Remote Code Execution VulnerabilityCVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-76419Nov 4, 2026Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseCVE-2026-20241Oct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security AdvisoriesCVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
Get an email when Cisco publishes the next one.
See Cisco's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
