Review reviewHigh

CVE-2026-20156

Cisco Cisco RoomOS Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20156 are related to improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.

CVSS: 8.1
EPSS: 0.23%
CISA KEV: Not listed
Published: 2026.07.16

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.23%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: Cisco Cisco RoomOS Software
Affected versions: >= RoomOS 10.11.2.2, >= RoomOS 10.15.2.2, >= RoomOS 11.5.4.6, >= RoomOS 11.5.2.4, >= RoomOS 10.8.2.5, >= RoomOS 10.11.5.2, >= RoomOS 10.11.3.0, >= RoomOS 10.15.5.3, >= RoomOS 10.19.2.2, >= RoomOS 11.1.3.1, >= RoomOS 10.11.6.0, >= RoomOS 10.19.3.0, >= RoomOS 10.19.4.2, >= RoomOS 10.3.2.4, >= RoomOS 10.3.4.0, >= RoomOS 10.15.3.0, >= RoomOS 11.1.4.1, >= RoomOS 11.14.2.3, >= RoomOS 11.1.2.4, >= RoomOS 10.8.3.1
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Cisco Cisco RoomOS Software and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-119