Cyber Resilience

CVE-2026-20172

Published
06 May 2026
Modified
17 June 2026
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0013 3th percentile
Risk Priority 34 floored blend · peak EPSS

Summary

CVE-2026-20172 is a medium-severity Reliance on File Name or Extension of Externally-Supplied File (CWE-646) vulnerability in Cisco Enterprise Chat (inferred from references). Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Double File Extension (T1036.007); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at…

more

least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks. 

CWE(s)
CWE-646

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036.007 Double File Extension Stealth
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1036.002 Right-to-Left Override Stealth
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.
attack.mitre.org →
T1036.006 Space after Filename Stealth
Adversaries can hide a program's true filetype by changing the extension of a file.
attack.mitre.org →
T1036.008 Masquerade File Type Stealth
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-52052Shared CWE-646
CVE-2025-30662Shared CWE-646
CVE-2025-41720Shared CWE-646
CVE-2025-58449Shared CWE-646
CVE-2025-1889Shared CWE-646
CVE-2023-45599Shared CWE-646
CVE-2024-38432Shared CWE-646
CVE-2026-45315Shared CWE-646

Affected Assets

Cisco
Enterprise Chat
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Requires validation of information inputs, which structurally stops reliance on untrusted file names or extensions by forcing content-based checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require content-based validation instead of trusting file extensions for externally supplied files.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect the weakness, but the control does not guarantee its elimination.

A.8.19 Installation of software on operational systems partial match
degrades

Restricting software installation can limit dangerous file types but does not enforce content-based validation.

A.8.23 Web filtering partial match
degrades

Web filtering can block risky file extensions but does not address server-side file handling logic.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC requires proper file-type validation, directly mitigating reliance on untrusted names or extensions.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate content inspection, but the control itself does not prescribe the technique.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage safe file handling, yet the control is broader than this specific weakness.

References