Cisco Webex Services Cross-Site Scripting Vulnerability

A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is needed.

This vulnerability was due to improper filtering of user-supplied input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.

As mentioned, Cisco has addressed this vulnerability in the Cisco Webex service, and no customer action is necessary to update on-premises software or devices. There are no workarounds that address this vulnerability.

CVE-2026-20149 — Cisco Webex Services Cross-Site Scripting Vulnerability (CVSS 3.1 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)