CVE-2026-20172
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-05-06 17:16:20.880000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-20172",
"sourceIdentifier": "[email protected]",
"published": "2026-05-06T17:16:20.880",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent.\r\n\r\nThis vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks. "
},
{
"lang": "es",
"value": "Una vulnerabilidad en la función Lite Agent de Cisco Enterprise Chat and Email (ECE) podría permitir a un atacante remoto autenticado realizar ataques basados en el navegador. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas para una cuenta de usuario con al menos el rol de Agente.\n\nEsta vulnerabilidad se debe a una validación inadecuada del contenido de los archivos durante las operaciones de carga de archivos. Un atacante podría explotar esta vulnerabilidad al cargar un archivo que contenga scripts maliciosos o código HTML, que la aplicación podría poner a disposición para que otros usuarios accedan. Un exploit exitoso podría permitir al atacante ejecutar el contenido de ese archivo en el navegador de un usuario y realizar ataques basados en el navegador. "
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Enterprise Chat and Email",
"defaultStatus": "unknown",
"versions": [
{
"version": "11.6(1)_ES3",
"status": "affected"
},
{
"version": "11.6(1)_ES4",
"status": "affected"
},
{
"version": "12.0(1)_ES6",
"status": "affected"
},
{
"version": "11.6(1)_ES8",
"status": "affected"
},
{
"version": "12.0(1)_ES5a",
"status": "affected"
},
{
"version": "11.6(1)_ES9",
"status": "affected"
},
{
"version": "12.0(1)_ES6_ET1",
"status": "affected"
},
{
"version": "11.6(1)_ES6",
"status": "affected"
},
{
"version": "11.6(1)_ES5",
"status": "affected"
},
{
"version": "12.5(1)_ET1",
"status": "affected"
},
{
"version": "12.5(1)",
"status": "affected"
},
{
"version": "12.5(1)_ES3_ET1",
"status": "affected"
},
{
"version": "12.0(1)_ES3",
"status": "affected"
},
{
"version": "11.6(1)_ES11",
"status": "affected"
},
{
"version": "12.0(1)_ES4",
"status": "affected"
},
{
"version": "12.0(1)_ES5",
"status": "affected"
},
{
"version": "11.6(1)_ES2",
"status": "affected"
},
{
"version": "11.6(1)_ES9a",
"status": "affected"
},
{
"version": "11.6(1)_ES10",
"status": "affected"
},
{
"version": "12.0(1)_ES1",
"status": "affected"
},
{
"version": "12.0(1)",
"status": "affected"
},
{
"version": "12.5(1)_ES3",
"status": "affected"
},
{
"version": "12.6(1)",
"status": "affected"
},
{
"version": "11.5(1)",
"status": "affected"
},
{
"version": "12.0(1)_ES2",
"status": "affected"
},
{
"version": "11.6(1)_ES7",
"status": "affected"
},
{
"version": "12.5(1)_ES2",
"status": "affected"
},
{
"version": "12.6(1)_ET1",
"status": "affected"
},
{
"version": "11.6(1)",
"status": "affected"
},
{
"version": "12.5(1)_ES1",
"status": "affected"
},
{
"version": "12.6(1)_ET2",
"status": "affected"
},
{
"version": "12.5(1)_ES3_ET2",
"status": "affected"
},
{
"version": "12.0(1)_ES6_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES1",
"status": "affected"
},
{
"version": "12.5(1)_ES4",
"status": "affected"
},
{
"version": "11.6(1)_ES12",
"status": "affected"
},
{
"version": "12.6(1)_ET3",
"status": "affected"
},
{
"version": "12.5(1)_ES4_ET1",
"status": "affected"
},
{
"version": "12.0(1)_ES6_ET3",
"status": "affected"
},
{
"version": "12.6(1)_ES1_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES2",
"status": "affected"
},
{
"version": "12.6_ES2_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES5",
"status": "affected"
},
{
"version": "12.6_ES2_ET2",
"status": "affected"
},
{
"version": "12.0(1)_ES7",
"status": "affected"
},
{
"version": "12.6_ES2_ET3",
"status": "affected"
},
{
"version": "12.0(1)_ES7_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES5_ET1",
"status": "affected"
},
{
"version": "12.6_ES2_ET4",
"status": "affected"
},
{
"version": "12.6(1)_ES3",
"status": "affected"
},
{
"version": "11.6(1)_ES12_ET1",
"status": "affected"
},
{
"version": "12.6_ES3_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES6",
"status": "affected"
},
{
"version": "12.6_ES3_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES4",
"status": "affected"
},
{
"version": "12.5(1)_ES7",
"status": "affected"
},
{
"version": "12.6(1)_ES4_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES5",
"status": "affected"
},
{
"version": "12.6(1)_ES5_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES5_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES6",
"status": "affected"
},
{
"version": "12.6(1)_ES6_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES8",
"status": "affected"
},
{
"version": "12.6(1)_ES6_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES7",
"status": "affected"
},
{
"version": "12.6(1)_ES8",
"status": "affected"
},
{
"version": "12.6(1)_ES4_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES3_ET3",
"status": "affected"
},
{
"version": "12.6(1)_ES2_ET5",
"status": "affected"
},
{
"version": "12.6(1)_ES1_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES8_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES7_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES6_ET3",
"status": "affected"
},
{
"version": "12.6(1)_ES5_ET3",
"status": "affected"
},
{
"version": "12.5(1)_ES8_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES3_ET3",
"status": "affected"
},
{
"version": "12.5(1)_ES5_ET2",
"status": "affected"
},
{
"version": "12.5(1)_ES6_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES4_ET2",
"status": "affected"
},
{
"version": "12.5(1)_ES7_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES8_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES9",
"status": "affected"
},
{
"version": "12.6(1)_ES9_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES9",
"status": "affected"
},
{
"version": "12.6(1)_ES9_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES9_ET3",
"status": "affected"
},
{
"version": "12.6(1)_ES10",
"status": "affected"
},
{
"version": "12.6(1)_ES10_ET1",
"status": "affected"
},
{
"version": "15.0(1)",
"status": "affected"
},
{
"version": "12.6(1)_ES11",
"status": "affected"
},
{
"version": "15.0(1)_ET1",
"status": "affected"
},
{
"version": "15.0(1)ES202508",
"status": "affected"
},
{
"version": "12.6(1)_ES11_ET1",
"status": "affected"
},
{
"version": "12.6(1)_ES11_ET2",
"status": "affected"
},
{
"version": "12.6(1)_ES12",
"status": "affected"
},
{
"version": "15.0(1)ES202511",
"status": "affected"
},
{
"version": "12.6(1)_ES12_ET1",
"status": "affected"
},
{
"version": "15.0(1)ES202511_ET1",
"status": "affected"
},
{
"version": "12.5(1)_ES10",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-06T17:45:56.726902Z",
"id": "CVE-2026-20172",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-646"
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-lite-agent-BCgSN8eb",
"source": "[email protected]"
}
]
}