[Content]
Forwarded from TWCERTCC-200-202602-00000003

Cisco Meeting Management provides an administrative web interface for monitoring and managing video conferences, including functions such as adding or removing participants, muting participants, changing screen layouts, and initiating recordings. Cisco has recently released a critical security advisory (CVE-2026-20098, CVSS: 8.8). This vulnerability is an arbitrary file upload vulnerability that may allow an authenticated remote attacker to upload arbitrary files, execute arbitrary commands, and escalate privileges on the affected system to root.

Note: To exploit this vulnerability, the attacker must possess valid credentials with at least Video Operator privileges.

(Information Sharing Level: WHITE (Information content can be publicly disclosed)

[Recommended Actions]
Please update to the following version:

Cisco Meeting Management 3.12.1 MR (including 3.12.1 MR) or later