CVE-2026-20119
Denial of Service in Cisco TelePresence via Text Rendering Flaw
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | telepresence_collaboration_endpoint | * |
| cisco | roomos | * |
| cisco | telepresence_collaboration_endpoint | 11.27.5.0 |
| cisco | telepresence_collaboration_endpoint | 11.32.3.0 |
| cisco | roomos | 11.27.5.0 |
| cisco | roomos | 11.32.3.0 |
| cisco | roomos | From 10 (inc) |
| cisco | roomos | to 10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1287 | The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20119 is a high-severity denial of service (DoS) vulnerability affecting Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. It exists in the text rendering subsystem due to insufficient validation of input received by the device.
An unauthenticated remote attacker can exploit this vulnerability by causing the affected device to render specially crafted text, such as a malicious meeting invitation. No user interaction is required for the exploit to succeed.
A successful exploit causes the device to reload, resulting in a denial of service condition where the device becomes unavailable.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial of service (DoS) condition on affected Cisco TelePresence Collaboration Endpoint or RoomOS devices.
An attacker can remotely and without authentication cause the device to reload unexpectedly by sending specially crafted text, such as a malicious meeting invitation.
This results in the device becoming temporarily unavailable, which can disrupt communications and collaboration services relying on these devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
This vulnerability has no available workarounds to mitigate the issue.
Cisco strongly recommends upgrading affected devices to fixed software versions to fully remediate the vulnerability.
- For on-premises devices, upgrade to Cisco TelePresence CE Software and RoomOS Software version 11.27.5.0 or 11.32.3.0.
- For cloud deployments, upgrade to RoomOS October 2025 or RoomOS December 2025 releases.
Ensure that fixed software is obtained through authorized channels and verify compatibility with existing hardware and software configurations.