Review reviewHigh

CVE-2026-20158

Cisco Cisco RoomOS Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20158 are related to improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

CVSS: 7.5
EPSS: 0.25%
CISA KEV: Not listed
Published: 2026.07.16

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.25%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Cisco Cisco RoomOS Software
Affected versions: >= RoomOS 10.11.2.2, >= RoomOS 10.15.2.2, >= RoomOS 11.5.4.6, >= RoomOS 11.5.2.4, >= RoomOS 10.8.2.5, >= RoomOS 10.11.5.2, >= RoomOS 10.11.3.0, >= RoomOS 10.15.5.3, >= RoomOS 10.19.2.2, >= RoomOS 11.1.3.1, >= RoomOS 10.11.6.0, >= RoomOS 10.19.3.0, >= RoomOS 10.19.4.2, >= RoomOS 10.3.2.4, >= RoomOS 10.3.4.0, >= RoomOS 10.15.3.0, >= RoomOS 11.1.4.1, >= RoomOS 11.14.2.3, >= RoomOS 11.1.2.4, >= RoomOS 10.8.3.1
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Cisco Cisco RoomOS Software and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-664