Cisco Webex Services Critical Vulnerability Lets Remote Attackers Impersonate Any User

Key Takeaways

• Cisco has disclosed a critical vulnerability, CVE-2026-20184, affecting its cloud-based Webex Services.
• The flaw allows unauthenticated remote attackers to bypass authentication and impersonate any user, particularly impacting organizations using Single Sign-On (SSO) integration.
• With a CVSS score of 9.8, the vulnerability demands immediate attention, despite no known active exploitation in the wild.
• While Cisco has patched its backend, affected customers must manually update their SAML certificates in Webex Control Hub to fully mitigate the risk.

Cisco has issued a critical security advisory concerning a severe vulnerability within its cloud-based Webex Services. This flaw, identified as CVE-2026-20184, has received the highest possible Common Vulnerability Scoring System (CVSS) base score of 9.8 out of 10, underscoring its extreme severity.

The advisory, published on April 15, 2026, reveals that this vulnerability could permit an unauthenticated, remote attacker to completely circumvent existing authentication mechanisms and assume the identity of any legitimate user on the platform.

Specifically, organizations that have integrated single sign-on (SSO) within the Webex Control Hub are affected by this critical issue.

Given Webex’s widespread use as an enterprise collaboration solution, the potential for an external threat actor to seamlessly impersonate users poses a substantial risk to corporate data integrity, internal communications, and the privacy of meetings.

Cisco Webex Services Vulnerability Explained

The root cause of this vulnerability lies in improper certificate validation within the Webex service’s SSO implementation, categorized under the weakness CWE-295. The system failed to correctly validate the security certificates employed to authenticate incoming connection requests when integrating an Identity Provider (IdP) for SSO.

Cisco’s technical details outline a relatively straightforward attack vector that threat actors could exploit:

• An unauthenticated attacker establishes a direct connection to a vulnerable Cisco Webex service endpoint.
• The attacker then provides a specially crafted authentication token.
• Due to the improper validation process, the system erroneously accepts this malicious token as legitimate.
• The attacker is immediately granted unauthorized access and can fully impersonate the targeted user account.

While Cisco has already deployed a patch to the backend infrastructure of its cloud-based Webex Services, this server-side update alone is insufficient to fully resolve the issue for end-users. Cisco has explicitly stated that no temporary workarounds are available for this vulnerability.

To fully secure their environments and prevent potential service disruptions, affected customers are required to take immediate manual action. Administrators of organizations utilizing SSO integration must upload a new SAML certificate for their Identity Provider (IdP) directly to the Webex Control Hub. Organizations that fail to update their SAML certificates face ongoing exposure to potential impersonation attacks and may experience disrupted connectivity to their Webex services.

Active Threat Status

Fortunately, this critical flaw was identified during internal security testing conducted by Cisco’s own engineering teams. The Cisco Product Security Incident Response Team (PSIRT) has confirmed that, as of the publication date, there have been no public disclosures of the flaw. Furthermore, current threat intelligence indicates no evidence of malicious exploitation or zero-day attacks leveraging CVE-2026-20184 in the wild.

Despite the absence of active exploitation, the 9.8 CVSS score dictates that organizations must treat this vulnerability with the highest priority. Administrators are strongly advised to review the official Cisco Security Advisory (cisco-sa-webex-cui-cert-8jSZYhWL) and immediately follow the official documentation for managing their single sign-on integration in Control Hub.

What You Should Do

• Review the official Cisco Security Advisory for CVE-2026-20184 immediately.
• If your organization uses Single Sign-On (SSO) integration with Webex Control Hub, you must upload a new SAML certificate for your Identity Provider (IdP).
• Follow Cisco’s official documentation for managing SSO integration in Control Hub to ensure correct certificate renewal and upload.
• Verify that the new SAML certificate is correctly configured and that Webex services are functioning as expected after the update.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.