The vulnerability stems from insufficient validation of user‑supplied SSL certificates. An authenticated attacker can upload a crafted certificate to the Cisco ThousandEyes Virtual Appliance, which results in arbitrary code execution as root on the underlying operating system. The weakness is classified as CWE‑74 and is rated with a CVSS score of 4.7.

The affected product is Cisco ThousandEyes Virtual Appliance, specifically the enterprise agent component. No version or build information was supplied, so all current deployments of the appliance are considered vulnerable until a patch is applied.

Although the CVSS score indicates moderate severity, the capability to execute root commands makes this a serious risk for systems that are controlled by the appliance. Exploitation requires valid administrative credentials, limiting the attack surface to privileged users or compromised accounts. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but organizations should treat the situation as a potential high‑impact event if an attacker gains admin access.