CVE-2026-20028— Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability
Possible ATT&CK Techniques 1AI
T1548.002 · Bypass User Account ControlAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Terminal Services Agent | TSAgent-1.3 | affected |
TSAgent-1.4.2 | affected | ||
TSAgent-1.2 | affected | ||
TSAgent-1.4 | affected | ||
TSAgent-1.0 | affected | ||
TSAgent-1.4.1 | affected | ||
TSAgent-1.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20028
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker. This vulnerability is due to an incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials could exploit this vulnerability by sending crafted network traffic to an affected device. A successful exploit could allow the attacker to inherit the firewall rules associated with a different user in the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Terminal Services Agent | TSAgent-1.3 | - |
II. Public POCs for CVE-2026-20028
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20028
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-20028 (1)
Same Patch Batch · Cisco · 2026-08-05 · 23 CVEs total
| CVE-2026-20303 | 9.9 CRITICAL | Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities |
| CVE-2026-20304 | 9.9 CRITICAL | Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities |
| CVE-2026-20272 | 9.8 CRITICAL | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20310 | 9.1 CRITICAL | Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Ac |
| CVE-2026-20267 | 9.0 CRITICAL | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20312 | 8.8 HIGH | Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities |
| CVE-2026-20200 | 8.8 HIGH | Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulner |
| CVE-2026-20263 | 8.6 HIGH | Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability |
| CVE-2026-20301 | 8.6 HIGH | Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Serv |
| CVE-2026-20268 | 8.6 HIGH | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20273 | 8.6 HIGH | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20271 | 8.6 HIGH | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20270 | 8.6 HIGH | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20269 | 8.6 HIGH | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20124 | 7.7 HIGH | Cisco IOS XE Software SNMP Denial of Service Vulnerability |
| CVE-2026-20313 | 7.7 HIGH | Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities |
| CVE-2026-20288 | 6.5 MEDIUM | Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability |
| CVE-2026-20294 | 6.5 MEDIUM | Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability |
| CVE-2026-20311 | 6.3 MEDIUM | Cisco IOS XE Software Web UI Denial of Service Vulnerability |
| CVE-2026-20289 | 5.7 MEDIUM | Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Cisco
- CVE-2026-20313
Cisco Catalyst SD-WAN Security Hardening Release - Memory Co - CVE-2026-20311
Cisco IOS XE Software Web UI Denial of Service Vulnerability - CVE-2026-20289
Cisco RoomOS Logging Subsystem Information Disclosure Vulner - CVE-2026-20312
Cisco Catalyst SD-WAN Security Hardening Release - Informati - CVE-2026-20310
Cisco SD-WAN Software Security Hardening Release - Improper
Same weakness: CWE-266
- CVE-2026-66662
WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - P - CVE-2026-65559
WordPress Order Delivery Date for WooCommerce plugin <= 4.6. - CVE-2026-65507
WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulner - CVE-2026-28111
WordPress Forminator plugin <= 1.56.0 - Privilege Escalation - CVE-2026-18996
cosmicstack-labs mercury-agent run_command permissions.ts Pe
V. Comments for CVE-2026-20028
No comments yet