CVE-2026-20114: Medium severity Cisco IOS XE Software vulnerability
A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20114?
CVE-2026-20114 is rated as a high severity vulnerability due to its potential for privilege escalation in the Cisco IOS XE Software.
How do I fix CVE-2026-20114?
To mitigate CVE-2026-20114, upgrade to the latest version of Cisco IOS XE Software that addresses this vulnerability.
What are the potential impacts of CVE-2026-20114?
The potential impacts of CVE-2026-20114 include unauthorized access to management APIs, leading to privilege escalation and possible control over affected systems.
Is CVE-2026-20114 exploitable remotely?
Yes, CVE-2026-20114 can be exploited by an authenticated, remote attacker.
Who is affected by CVE-2026-20114?
CVE-2026-20114 affects users of Cisco IOS XE Software, specifically those implementing the Lobby Ambassador web-based management API.