CVE-2026-20172: cisco cisco enterprise chat and email

Vulnerability summary

CVE-2026-20172 is a medium (CVSS 4.3) vulnerability in cisco cisco enterprise chat and email. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 1.9% of scored vulnerabilities.

Timeline

1. 06-05-2026
   PublishedVulnerability first disclosed.
2. 06-05-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.

• CWE-646Reliance on File Name or Extension of Externally-Supplied FileThe product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.