CVE-2026-20161

CVE-2026-20161 is a local privilege escalation vulnerability affecting Cisco ThousandEyes Enterprise Agent's command-line interface that permits authenticated users with minimal privileges to overwrite arbitrary files through symbolic link manipulation and inadequate file access controls. The vulnerability carries a CVSS score of 5.5 (Medium) with a local attack vector requiring low user privileges and no user interaction. The attack has low complexity and could result in high integrity impact, though confidentiality and availability are not affected. The EPSS score of 0.00012 indicates minimal observed exploitation activity relative to the broader CVE landscape. There is currently no evidence of active exploitation, no public exploit code availability, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog or industry hot lists. The combination of low EPSS score and inactive threat status suggests this remains a theoretical risk with limited real-world weaponization at this time.