CVE-2026-20350
CVE-2026-20350: 1 tracked advisory record across Cisco. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Cisco
1 advisory- Advisory severityMedium4.7
Medium [CVE-2026-20350] Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability
cisco-sa-teva-os-command-W4GAO6jpSource published Source updated
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Affected products in this advisory
- ThousandEyes Enterprise Agent
- ThousandEyes Endpoint Agent
- Source-reported affected versions
- Scope: At the time of publication, this vulnerability affected Cisco ThousandEyes Virtual Appliance, regardless of device configuration.
- Release Earlier than 0.265 (first fixed: 0.265.0)
- Source-reported fixed versions
- 0.265.0
- Mitigation guidance
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Earlier than 0.265: upgrade to 0.265.0.
- Workarounds
- There are no workarounds that address this vulnerability.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.