Is CVE-2026-20178 actively exploited?

No active exploitation of CVE-2026-20178 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-20178 be exploited remotely?

Yes. CVE-2026-20178 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-20178?

CVE-2026-20178 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-20178

MEDIUM

CVE-2026-20178

CWE-601Published: June 17, 2026· Updated: Jun 22, 2026

4.3

CVSS v3.1

Official Description

A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage. Cisco has addressed this vulnerability in the Cisco Webex App, and no customer action is needed.

This vulnerability existed due to improper input validation of URL parameters in an HTTP request. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to click a crafted URL. A successful exploit could have allowed the attacker to redirect a user to a malicious website.

NVD Source

Technical Analysis

CVE-2026-20178 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.