CVE-2026-20161

MediumCVSS 5.5

Published: 15/04/2026(UTC)Updated: 25/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This is due to improper access controls on local files; an attacker could place a symbolic link in a specific location to bypass file system permissions.

Risk Assessment

A local attacker could overwrite critical system files, potentially leading to privilege escalation or system compromise.

Recommendation

Update Cisco ThousandEyes Enterprise Agent to a patched version and restrict local access to the device.

Other vulnerabilities in Cisco ThousandEyes Enterprise Agent

CVE-2026-20206Medium
Cisco ThousandEyes Enterprise Agent has a vulnerability in the BrowserBot component that allows an authenticated remote attacker to execute arbitrary commands in the BrowserBot container as the node user. The vulnerability is due to insufficient input validation of command arguments.

Original NVD description (English source)

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system of an affected device. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to bypass file system permissions and overwrite arbitrary files on the affected device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS