{"schemaVersion":3,"id":"CVE-2026-20156","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\n\nThe vulnerabilities tracked by CVE-2026-20156 are related to improper restriction of operations within the bounds of a memory buffer that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-119.","dates":{"published":"2026-07-15T16:17:52.307Z","modified":"2026-08-14T21:00:52.875Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00459,"percentile":0.38446,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.203,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00256},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00459,"percentile":0.38446}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00459,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00459,"percentile":0.38446}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"cisco","product":"cisco roomos software","name":"Cisco RoomOS Software","label":"cisco roomos software","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"RoomOS 10.11.2.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.15.2.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.5.4.6","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.5.2.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.8.2.5","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.11.5.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.11.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.15.5.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.19.2.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.1.3.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.11.6.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.19.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.19.4.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.3.2.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.3.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.15.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.1.4.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.14.2.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.1.2.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.8.3.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.14.2.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.3.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.8.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.15.4.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.19.5.6","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.11.4.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.9.3.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.5.3.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.3.2.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.9.2.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.14.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.17.2.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.14.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 10.19 StepUpg","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.17.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.20.2.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.14.5.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.17.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.20.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.23.1.6","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.23.1.8","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.24.1.5","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.24.2.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.24.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.24.4.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.27.2.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.28.1.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.27.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.31.1.5","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.27.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.32.2.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.33.1.7","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.0.1.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.34.1.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.32.3.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.27.5.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.32.4.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.1.1.5","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.35.1.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.2.2.2","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.32.5.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.4.1.6","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.4.1.4","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.3.1.3","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.36.1.1","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.37.1.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 26.5.2.0","noFixRecorded":false,"fixedIn":null},{"text":"RoomOS 11.38.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"RoomOS 10.11.2.2 | RoomOS 10.15.2.2 | RoomOS 11.5.4.6 | RoomOS 11.5.2.4 | RoomOS 10.8.2.5 | RoomOS 10.11.5.2 | RoomOS 10.11.3.0 | RoomOS 10.15.5.3 | RoomOS 10.19.2.2 | RoomOS 11.1.3.1 | RoomOS 10.11.6.0 | RoomOS 10.19.3.0 | RoomOS 10.19.4.2 | RoomOS 10.3.2.4 | RoomOS 10.3.4.0 | RoomOS 10.15.3.0 | RoomOS 11.1.4.1 | RoomOS 11.14.2.3 | RoomOS 11.1.2.4 | RoomOS 10.8.3.1 | RoomOS 11.14.2.1 | RoomOS 10.3.3.0 | RoomOS 10.8.4.0 | RoomOS 10.15.4.1 | RoomOS 10.19.5.6 | RoomOS 10.11.4.1 | RoomOS 11.9.3.1 | RoomOS 11.5.3.3 | RoomOS 10.3.2.0 | RoomOS 11.9.2.4 | RoomOS 11.14.3.0 | RoomOS 11.17.2.2 | RoomOS 11.14.4.0 | RoomOS 10.19 StepUpg | RoomOS 11.17.3.0 | RoomOS 11.20.2.3 | RoomOS 11.14.5.0 | RoomOS 11.17.4.0 | RoomOS 11.20.3.0 | RoomOS 11.23.1.6 | RoomOS 11.23.1.8 | RoomOS 11.24.1.5 | RoomOS 11.24.2.4 | RoomOS 11.24.3.0 | RoomOS 11.24.4.1 | RoomOS 11.27.2.0 | RoomOS 11.28.1.3 | RoomOS 11.27.3.0 | RoomOS 11.31.1.5 | RoomOS 11.27.4.0 | RoomOS 11.32.2.1 | RoomOS 11.33.1.7 | RoomOS 26.0.1.2 | RoomOS 11.34.1.2 | RoomOS 11.32.3.0 | RoomOS 11.27.5.0 | RoomOS 11.32.4.0 | RoomOS 26.1.1.5 | RoomOS 11.35.1.2 | RoomOS 26.2.2.2 | RoomOS 11.32.5.1 | RoomOS 26.4.1.6 | RoomOS 26.4.1.4 | RoomOS 26.3.1.3 | RoomOS 11.36.1.1 | RoomOS 11.37.1.0 | RoomOS 26.5.2.0 | RoomOS 11.38.1.1","eol":null,"hubHref":"/vendor/cisco/cisco_roomos_software"},{"vendor":"cisco","product":"roomos","name":"roomos","label":"roomos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 11.32.6.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.0.1.2, < 26.5.2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.32.6.0 | ≥ 26.0.1.2, < 26.5.2.2","eol":null,"hubHref":"/vendor/cisco/roomos"},{"vendor":"cisco","product":"roomos_cloud","name":"roomos cloud","label":"roomos_cloud","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 11.39.1.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.0.1.2, < 26.7.1.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.39.1.1 | ≥ 26.0.1.2, < 26.7.1.7","eol":null,"hubHref":"/vendor/cisco/roomos_cloud"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq","label":"sec.cloudapps.cisco.com/security/…","hostname":"sec.cloudapps.cisco.com","tags":["Vendor Advisory"]},{"url":"https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification","label":"www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification","hostname":"www.cve.org","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-07-15T16:17:52.307Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-14T21:00:52.875Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:11:27.591Z","stale":false,"partial":false}}