CVE-2026-20161CWE-59

Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability

Medium · published April 15, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device.

This vulnerability is due to improper access controls on files that are on the local file system of an affected device. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to bypass file system permissions and overwrite arbitrary files on the affected device.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-04-15T16:03Z
EPSS history
Timeline
  • 15 APR 16:03Z
    Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability
    cvelistv5