HOMEVULNERABILITIESCVE-2026-20114
MEDIUM

CVE-2026-20114

CWE-1286Published: March 25, 2026· Updated: Mar 26, 2026

5.4
CVSS v3.1
EPSS:0.03%probability of exploitation in 30 daysPercentile:7.0th

Official Description

A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users.

This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.

NVD Source

Technical Analysis

CVE-2026-20114 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Vendors & Products

Mentioned vendors (from description):
Cisco
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (1)

Quick Facts

CVE IDCVE-2026-20114
CVSS Score5.4 / 10
SeverityMEDIUM
WeaknessCWE-1286
CISA KEVNo
EPSS (30d)0.03%
PublishedMar 25, 2026

Related CVEs (CWE-1286)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2026-20114 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.