by Kastro
Paper/Archive/CVE-2026-20157

CVE-2026-20157

Cisco Cisco RoomOS Software — Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
31
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 9.0.090 × 201.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20157 are related to missing encryption that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-311.

Affected

ProductAffectedFixed inSource
Cisco RoomOS SoftwareRoomOS 10.11.2.2–CNA
Cisco RoomOS SoftwareRoomOS 10.15.2.2–CNA
Cisco RoomOS SoftwareRoomOS 11.5.4.6–CNA
Cisco RoomOS SoftwareRoomOS 11.5.2.4–CNA
Cisco RoomOS SoftwareRoomOS 10.8.2.5–CNA
Cisco RoomOS SoftwareRoomOS 10.11.5.2–CNA
Cisco RoomOS SoftwareRoomOS 10.11.3.0–CNA
Cisco RoomOS SoftwareRoomOS 10.15.5.3–CNA
Cisco RoomOS SoftwareRoomOS 10.19.2.2–CNA
Cisco RoomOS SoftwareRoomOS 11.1.3.1–CNA
Cisco RoomOS SoftwareRoomOS 10.11.6.0–CNA
Cisco RoomOS SoftwareRoomOS 10.19.3.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisco (CNA)7.5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEqrefcve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification