CVE-2026-20246CWE-269

Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability

Medium · published June 17, 2026

CVSS v3.1
6.0
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device.

This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00104 · 1.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-06-17T16:17Z
EPSS history
Timeline
  • 17 JUN 16:17Z
    Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability
    cvelistv5