CVE-2026-20233
published 2026-06-03CVE-2026-20233: A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.18%
8.3th percentile
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.
This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Affected
112 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Cisco Webex Meetings up to 45.4 Web-based User Interface cross site scripting (cisco-sa-webex-xss-jw3NeQzS)
vuldb·2026-06-03·CVSS 6.1
CVE-2026-20233 [MEDIUM] Cisco Webex Meetings up to 45.4 Web-based User Interface cross site scripting (cisco-sa-webex-xss-jw3NeQzS)
A vulnerability marked as problematic has been reported in Cisco Webex Meetings. This affects an unknown part of the component Web-based User Interface. The manipulation leads to cross site scripting.
This vulnerability is listed as CVE-2026-20233. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
ghsa_unreviewed·2026-06-03
CVE-2026-20233 [MEDIUM] CWE-79 A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.
This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-03
Published