CVE-2026-20246

A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AU	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:umbrella_virtual_appliance:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-17 17:16

Updated : 2026-06-22 13:24

NVD link : CVE-2026-20246

Mitre link : CVE-2026-20246

CVE.ORG link : CVE-2026-20246

JSON object : View

Products Affected

cisco

umbrella_virtual_appliance

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-20246", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20246", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T17:15:44.900787Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Umbrella Insights Virtual Appliance", "versions": [{"status": "affected", "version": "2.6.0"}, {"status": "affected", "version": "2.5.6"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.4.12"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.6.2"}, {"status": "affected", "version": "2.5.5"}, {"status": "affected", "version": "2.5.4"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.6.1"}, {"status": "affected", "version": "2.5.7"}, {"status": "affected", "version": "1.5.4"}, {"status": "affected", "version": "1.5.5"}, {"status": "affected", "version": "1.5.6"}, {"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.1.4"}, {"status": "affected", "version": "2.1.5"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.3.1"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.4.4"}, {"status": "affected", "version": "2.4.6"}, {"status": "affected", "version": "2.8.9"}, {"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "2.8.1"}, {"status": "affected", "version": "2.8.2"}, {"status": "affected", "version": "2.8.3"}, {"status": "affected", "version": "2.8.4"}, {"status": "affected", "version": "2.8.5"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.1.1"}, {"status": "affected", "version": "3.1.2"}, {"status": "affected", "version": "3.1.3"}, {"status": "affected", "version": "3.1.4"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.3.1"}, {"status": "affected", "version": "3.3.2"}, {"status": "affected", "version": "3.3.3"}, {"status": "affected", "version": "3.3.4"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.4.1"}, {"status": "affected", "version": "3.4.2"}, {"status": "affected", "version": "3.4.3"}, {"status": "affected", "version": "3.4.4"}, {"status": "affected", "version": "3.4.5"}, {"status": "affected", "version": "3.4.6"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.6"}, {"status": "affected", "version": "2.7.9"}, {"status": "affected", "version": "2.7.10"}, {"status": "affected", "version": "3.5.1"}, {"status": "affected", "version": "3.5.2"}, {"status": "affected", "version": "3.6.1"}, {"status": "affected", "version": "3.6.2"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.7.1"}, {"status": "affected", "version": "3.8.3"}], "defaultStatus": "unknown"}]}], "published": "2026-06-17T17:16:43.423", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-priv-esc-F4wJB7AU", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root."}], "lastModified": "2026-06-22T13:24:17.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:umbrella_virtual_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "747DFEB4-0F17-4600-8E22-ECB545A12EE8", "versionEndExcluding": "3.8.5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}