CVE-2026-20233

Cisco Webex Meetings Cross-Site Scripting Vulnerability

Published Jun 3, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.

This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

Analysis

Technical impact

The disclosed issue is a client‑side cross‑site scripting vulnerability in the web‑based interface of Cisco Webex Meetings. An unauthenticated remote attacker could persuade a victim to click a malicious link, causing arbitrary JavaScript to run in the victim’s browser. This could allow the attacker to execute arbitrary code, steal session data, or read sensitive browser‑based information, posing a moderate confidentiality and integrity risk.

Affected Systems

Cisco Webex Meetings, a collaboration platform offered by Cisco. All installations that use the web‑based user interface are potentially affected; the advisory does not list specific version numbers, so current releases are assumed impacted until the issue is patched.

Risk and Exploitability

The vulnerability has a CVSS score of 6.1, indicating moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires social engineering to get the user to open a crafted link, limiting but not eliminating risk. Cisco has released a fix and states no customer action is required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Webex Meetings

unknown

Version	Status	Constraints
`39.7.7`	affected	—
`39.9`	affected	—
`40.4.10`	affected	—
`39.6`	affected	—
`40.6.2`	affected	—
`39.8.2`	affected	—
`39.8.4`	affected	—
`40.1`	affected	—
`39.11`	affected	—
`39.7.4`	affected	—
`39.9.1`	affected	—
`40.4`	affected	—
`40.6`	affected	—
`39.7`	affected	—
`39.8`	affected	—
`39.8.3`	affected	—
`40.2`	affected	—
`39.10`	affected	—
`42.6`	affected	—
`42.7`	affected	—
`42.8`	affected	—
`42.9`	affected	—
`42.10`	affected	—
`42.11`	affected	—
`42.12`	affected	—
`43.1`	affected	—
`43.2`	affected	—
`43.3`	affected	—
`43.4`	affected	—
`43.4.1`	affected	—
`43.4.2`	affected	—
`43.5.0`	affected	—
`43.6.0`	affected	—
`43.6.1`	affected	—
`43.7`	affected	—
`43.8`	affected	—
`43.9`	affected	—
`43.10`	affected	—
`43.11`	affected	—
`43.12`	affected	—
`44.1`	affected	—
`44.2`	affected	—
`44.3`	affected	—
`44.4`	affected	—
`44.5`	affected	—
`44.6`	affected	—
`44.7`	affected	—
`44.8`	affected	—
`44.9`	affected	—
`44.10`	affected	—
`44.11`	affected	—
`44.12`	affected	—
`45.1`	affected	—
`45.2`	affected	—
`45.3`	affected	—
`45.4`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:cisco:webex_meetings:39.6.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.7.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.7.4:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.7.7:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.8.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.8.2:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.8.3:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.8.4:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.9.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.9.1:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.10.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:39.11.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.1.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.2.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.4.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.4.10:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.6.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:40.6.2:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.6.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.7.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.8.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.9.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.10.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.11.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:42.12.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.1.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.2.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.3.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.4.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.4.1:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.4.2:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.5.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.6.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.6.1:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.7.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.8.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.9.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.10.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.11.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:43.12.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.1.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.2.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.3.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.4.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.5.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.6.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.7.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.8.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.9.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.10.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.11.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:44.12.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:45.1.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:45.2.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:45.3.0:::::::*
	cpe:2.3:a:cisco:webex_meetings:45.4.0:::::::*

No data.

Vendor Product Versions

Cisco

Webex Meetings

Version	Status	Scheme	Platform
`39.7.7`	affected	semver	—
`39.9`	affected	generic	—
`40.4.10`	affected	semver	—
`39.6`	affected	generic	—
`40.6.2`	affected	semver	—
`39.8.2`	affected	generic	—
`39.8.4`	affected	semver	—
`40.1`	affected	generic	—
`39.11`	affected	generic	—
`39.7.4`	affected	generic	—
`39.9.1`	affected	semver	—
`40.4`	affected	generic	—
`40.6`	affected	generic	—
`39.7`	affected	generic	—
`39.8`	affected	generic	—
`39.8.3`	affected	generic	—
`40.2`	affected	generic	—
`39.10`	affected	generic	—
`42.6`	affected	generic	—
`42.7`	affected	generic	—
`42.8`	affected	generic	—
`42.9`	affected	generic	—
`42.10`	affected	generic	—
`42.11`	affected	generic	—
`42.12`	affected	generic	—
`43.1`	affected	generic	—
`43.2`	affected	generic	—
`43.3`	affected	generic	—
`43.4`	affected	generic	—
`43.4.1`	affected	semver	—
`43.4.2`	affected	semver	—
`43.5.0`	affected	semver	—
`43.6.0`	affected	semver	—
`43.6.1`	affected	semver	—
`43.7`	affected	generic	—
`43.8`	affected	generic	—
`43.9`	affected	generic	—
`43.10`	affected	generic	—
`43.11`	affected	generic	—
`43.12`	affected	generic	—
`44.1`	affected	generic	—
`44.2`	affected	generic	—
`44.3`	affected	generic	—
`44.4`	affected	generic	—
`44.5`	affected	generic	—
`44.6`	affected	generic	—
`44.7`	affected	generic	—
`44.8`	affected	generic	—
`44.9`	affected	generic	—
`44.10`	affected	generic	—
`44.11`	affected	generic	—
`44.12`	affected	generic	—
`45.1`	affected	generic	—
`45.2`	affected	generic	—
`45.3`	affected	generic	—
`45.4`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Configure a Content Security Policy that restricts inline script execution and controls script sources.
Conduct user awareness training to recognize suspicious links and phishing attempts.
Enable advanced browser security features such as script execution blocking or antivirus protection to mitigate XSS.

Generated by OpenCVE AI on June 3, 2026 at 19:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.184% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzS

History

Jun 8, 2026 1:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:cisco:webex_meetings:39.10.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.11.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.6.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.7.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.7.4:::::::* cpe:2.3:a:cisco:webex_meetings:39.7.7:::::::* cpe:2.3:a:cisco:webex_meetings:39.8.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.8.2:::::::* cpe:2.3:a:cisco:webex_meetings:39.8.3:::::::* cpe:2.3:a:cisco:webex_meetings:39.8.4:::::::* cpe:2.3:a:cisco:webex_meetings:39.9.0:::::::* cpe:2.3:a:cisco:webex_meetings:39.9.1:::::::* cpe:2.3:a:cisco:webex_meetings:40.1.0:::::::* cpe:2.3:a:cisco:webex_meetings:40.2.0:::::::* cpe:2.3:a:cisco:webex_meetings:40.4.0:::::::* cpe:2.3:a:cisco:webex_meetings:40.4.10:::::::* cpe:2.3:a:cisco:webex_meetings:40.6.0:::::::* cpe:2.3:a:cisco:webex_meetings:40.6.2:::::::* cpe:2.3:a:cisco:webex_meetings:42.10.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.11.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.12.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.6.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.7.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.8.0:::::::* cpe:2.3:a:cisco:webex_meetings:42.9.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.1.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.10.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.11.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.12.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.2.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.3.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.4.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.4.1:::::::* cpe:2.3:a:cisco:webex_meetings:43.4.2:::::::* cpe:2.3:a:cisco:webex_meetings:43.5.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.6.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.6.1:::::::* cpe:2.3:a:cisco:webex_meetings:43.7.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.8.0:::::::* cpe:2.3:a:cisco:webex_meetings:43.9.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.1.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.10.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.11.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.12.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.2.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.3.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.4.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.5.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.6.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.7.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.8.0:::::::* cpe:2.3:a:cisco:webex_meetings:44.9.0:::::::* cpe:2.3:a:cisco:webex_meetings:45.1.0:::::::* cpe:2.3:a:cisco:webex_meetings:45.2.0:::::::* cpe:2.3:a:cisco:webex_meetings:45.3.0:::::::* cpe:2.3:a:cisco:webex_meetings:45.4.0:::::::*

Jun 5, 2026 8:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco webex Meetings
Vendors & Products		Cisco Cisco webex Meetings

Jun 3, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 3, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed. This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Title		Cisco Webex Meetings Cross-Site Scripting Vulnerability
Weaknesses		CWE-79
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-jw3NeQzS
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`