Quick answers
- Is CVE-2026-20156 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20156 being exploited in the wild.
- How severe is CVE-2026-20156?
- High severity, with a CVSS score of 8.1, published 15 July 2026.
- Which products and versions are affected?
- Cisco RoomOS 11 and earlier; 26 before 26.5.2.2.
- Is there a fix for CVE-2026-20156?
- A patch was published on 2026-07-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20156 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-20156?
- Check whether you run Cisco RoomOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This advisory addresses a cluster of vulnerabilities categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), including buffer overflows and out-of-bounds writes. The vulnerabilities exist within Cisco RoomOS and can be triggered over the network. While the attack complexity is rated as high, a successful exploit could allow an unauthenticated remote attacker to achieve full compromise of confidentiality, integrity, and availability (RCE). The issues were discovered internally by Cisco using security testing processes and AI models. Fixed releases include RoomOS 11.32.6.0 (on-premises), 11.39.1.1 (cloud-aware), and 26.5.2.2.
Affected products
- Cisco RoomOS Software 11 and earlier; 26 before 26.5.2.2
Timeline
- 2026-07-15: advisory: Initial public release by Cisco
- 2026-07-15: patched