CVE-2026-20184: Cisco Webex SSO with Control Hub - Improper Certificate Validation Enables User Impersonation
CVE-2026-20184 affects the single sign-on integration between Cisco Webex Services and Control Hub. The flaw stems from improper certificate validation and, according to the record, could let an unauthenticated remote attacker impersonate any user in the service. The record reports a CVSS 3.1 base score of 9.8 (critical) and no KEV listing, but it lists no affected or fixed versions.
Overview
CVE-2026-20184 is a vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services. The weakness is classified as CWE-295, Improper Certificate Validation. According to the record, the flaw was addressed by the vendor, but the record does not include the technical details of the fix.
Impact
- The record states that an unauthenticated remote attacker could impersonate any user within the service.
- The record states that successful exploitation could grant unauthorized access to legitimate Cisco Webex services.
- The vendor's CVSS 3.1 base score is 9.8, which is rated critical.
Affected products and versions
The record identifies the affected component as the SSO integration with Control Hub in Cisco Webex Services. It does not list affected version ranges, affected builds or fixed versions. Administrators should consult the vendor advisory for the authoritative scope, as described in the Cisco security advisory.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability recorded is 0.0052, with a percentile of 0.42557, which reflects a statistical estimate and not confirmed exploitation.
Remediation and mitigation
- Review the vendor advisory linked above and confirm whether your Webex and Control Hub tenant configuration is covered by the fix.
- Because Webex is delivered as a service, many customers may depend on the provider to apply changes. Inference: confirm with the vendor or your administrator that the remediation has been applied to your tenant.
- Review SSO and identity provider configurations for Control Hub, and restrict administrative access to these settings to trusted personnel.
Detection guidance
- Review authentication logs for Webex and Control Hub for unexpected sign-ins, unusual sign-in sources, or access to accounts that do not match known user activity.
- Correlate identity provider logs with Webex audit logs to identify discrepancies between the authenticated identity and the activity performed.
- Escalate any anomalies to the security team and follow your incident response procedures.
Limitations of the available information
The record does not include affected version ranges, fixed version identifiers, detailed technical root-cause analysis, or indicators of compromise. The available CVSS score is taken from the record and attributed to the CNA. The exact timeline of the fix and its tenant-level deployment are unknown.
Frequently asked questions
What does CVE-2026-20184 allow an attacker to do?
According to the record, an unauthenticated remote attacker could impersonate any user within the Cisco Webex service through the SSO integration with Control Hub, which could grant unauthorized access to legitimate Webex services.
Is CVE-2026-20184 known to be actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The record does not provide further details on exploitation.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.