CVE-2026-20350
Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by saving configuration details that contain malicious values. A successful exploit could allow the attacker to execute arbitrary operating system commands with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials.
| CWE | CWE-78 |
| Vendor | cisco |
| Product | cisco thousandeyes enterprise agent |
| Ecosystems | |
| Industries | NetworkingTelecommunications |
| Published | Sep 16, 2026 |
Get instant alerts for cisco cisco thousandeyes enterprise agent
Be the first to know when new medium vulnerabilities affecting cisco cisco thousandeyes enterprise agent are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L