CVE-2026-20246
Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability
Description
A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root.
Weakness: CWE-269
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Umbrella | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Umbrella Insights Virtual Appliance
Vendor advisory
cisco-sa-umbrella-priv-esc-F4wJB7AU
Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability
Cisco’s rating: Medium (advisory CVSS 6.0) · Published Jun 17, 2026
Bug ID: CSCwt75291
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from