CVE-2026-20206
Command Injection in Cisco ThousandEyes Enterprise Agent
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | thousandeyes_enterprise_agent | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20206 is a command injection vulnerability in the BrowserBot component of the Cisco ThousandEyes Enterprise Agent.
An authenticated remote attacker with valid ThousandEyes SaaS credentials and the ability to manage transaction tests could exploit this flaw by submitting crafted input to execute arbitrary commands within the BrowserBot container as the node user.
The vulnerability is caused by insufficient input validation of command arguments supplied by the user.
Cisco has addressed this issue in the cloud-based ThousandEyes service, and no customer action is required.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary commands on the affected ThousandEyes Enterprise Agent within the BrowserBot container.
This could lead to unauthorized actions being performed on the system with the privileges of the node user, potentially compromising the integrity, confidentiality, and availability of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or methods provided to identify this vulnerability on your network or system.
Detection would generally require verifying if the affected version of Cisco ThousandEyes Enterprise Agent is in use and if an attacker has authenticated access to the ThousandEyes SaaS with permissions to manage transaction tests.
What immediate steps should I take to mitigate this vulnerability?
Cisco has addressed this vulnerability in the cloud-based ThousandEyes service, and no customer action is needed.
There are no available workarounds or immediate mitigation steps required from customers.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.