Cisco patches critical Webex SSO flaw and requires customers to upload a new SAML certificate
Summary
Cisco patched four critical flaws, including Webex SSO CVE-2026-20184, which could let unauthenticated attackers impersonate users. SSO customers must upload a new SAML certificate; Cisco reports no evidence of exploitation.
Key points
- CVE-2026-20184 affected Webex SSO integration with Control Hub; a crafted token sent to a service endpoint could let an unauthenticated attacker impersonate a user.
- Webex customers using SSO must upload a new SAML certificate for their identity provider to Control Hub to avoid service interruption.
- Three critical ISE flaws (CVE-2026-20147, CVE-2026-20180, and CVE-2026-20186) could allow arbitrary operating-system command execution, but exploitation requires administrative credentials.
- Cisco also fixed 10 medium-severity flaws that could enable authentication bypass, privilege escalation, or denial of service.
- Cisco PSIRT said it had no evidence that the vulnerabilities addressed in the updates had been exploited.
- Separately, CISA had ordered federal agencies to patch CVE-2026-20131 in Secure Firewall Management Center, which the article says was exploited in Interlock ransomware attacks.
Article Details
- Vulnerability Types
- Improper certificate validation
- Arbitrary operating system command execution
- Severity
- Critical
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For Webex SSO, upload a new SAML certificate for the identity provider to Control Hub to avoid service interruption.
CVE
CVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)Ten additional medium-severity issues were fixed, PSIRT reported no evidence of exploitation, and CISA recently ordered a patch for an FMC zero-day exploited by Interlock ransomware (CVE-2026-20131).CVE-2026-20147Cisco · Cisco Identity Services Engine Software; Cisco · Cisco ISE Passive Identity ConnectorThree critical Identity Services Engine flaws (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) could enable arbitrary OS command execution if attackers have administrative credentials.CVE-2026-20180Cisco · Cisco Identity Services Engine SoftwareThree critical Identity Services Engine flaws (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) could enable arbitrary OS command execution if attackers have administrative credentials.CVE-2026-20184Cisco · Cisco Webex MeetingsCisco released security updates addressing four critical vulnerabilities, including a Webex SSO certificate-validation flaw (CVE-2026-20184) that could let unauthenticated attackers impersonate users.CVE-2026-20186Cisco · Cisco Identity Services Engine SoftwareThree critical Identity Services Engine flaws (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) could enable arbitrary OS command execution if attackers have administrative credentials.
Malware
Vendors
Products
Cisco Secure Firewall Management Centerfederal agencies to patch a maximum-severity vulnerability (CVE-2026-20131) in Cisco’s Secure Firewall Management Center (FMC) that had been exploited as a zero-day in Interlock ransomware attacks since lateControl HubCustomers using SSO must upload a new SAML certificate to Control Hub, and Cisco also patched critical ISE flaws while noting no evidence of active exploitation.Identity Services EngineThree critical Identity Services Engine flaws (CVE-2026-20147, CVE-2026-20180, CVE-2026-20186) could enable arbitrary OS command execution if attackers have administrative credentials.Webex Servicesvulnerabilities, including a fixed improper certificate validation flaw in the company’s cloud-based Webex Services platform that requires further customer action.