CVE-2026-20184

CVE-2026-20184 is a critical vulnerability in Cisco Webex Services affecting the SSO integration with Control Hub. The flaw stems from improper certificate validation, which allows an unauthenticated remote attacker to impersonate any user by supplying a crafted token to a service endpoint, potentially granting complete unauthorized access to legitimate Webex services. The vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no privileges or user interaction, indicating high severity across all impact categories including confidentiality, integrity, and availability. The attack complexity is low, making exploitation straightforward for threat actors with basic network access. Current exploitation status indicates this vulnerability is not actively being exploited in the wild, with no public exploit code confirmed available and no inclusion on the KEV or Hot List databases. However, the moderate FAUCET Risk Score of 55.0 suggests organizations should prioritize patching given the ease of exploitation and the severity of potential impact, despite the low current threat prevalence.