Security readout for executives and security teams
Plain-English summary
CVE-2026-20092 lets a highly privileged local administrator on Cisco Intersight Virtual Appliance potentially become root. This is not a remote internet bug based on the provided sources. The business risk is concentrated where read-only maintenance-shell access is broadly assigned or poorly monitored, because root control can expose sensitive data, alter configurations, and disrupt the appliance.
Executive priority
Treat as a targeted privilege-escalation risk, not a broad internet emergency. Prioritize environments where the appliance manages sensitive infrastructure or has many administrators. Confirm version exposure and follow Cisco guidance promptly.
Technical view
Cisco describes improper permissions on system account configuration files in the read-only maintenance shell. An authenticated local attacker with administrative privileges could manipulate system files and elevate to root. The CVSS v3.1 score is 6.0 with local attack vector, low complexity, high privileges required, and high confidentiality and integrity impact.
Likely exposure
Exposure appears limited to Cisco Intersight Virtual Appliance version 1.1.4-0 as listed in the provided data. Systems are most exposed when users have administrative access to the local maintenance shell, especially read-only administrators whose access is not tightly controlled.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked as CISA KEV. Exploitation requires authenticated local administrative access, so this is mainly an insider, compromised-admin, or post-compromise privilege escalation scenario rather than initial external compromise.
Researcher notes
The record attributes the issue to CWE-732 improper file permissions. Public details are limited to Cisco’s description and CVSS metadata. Avoid assuming affected versions beyond 1.1.4-0 or specific fixed releases unless confirmed in Cisco’s advisory.
Mitigation direction
- Review Cisco’s advisory for fixed versions, workarounds, or upgrade guidance.
- Limit maintenance-shell access to essential administrators only.
- Remove unnecessary read-only administrator accounts from affected appliances.
- Monitor administrative sessions and configuration changes on the appliance.
- Apply compensating access controls until vendor guidance is completed.
Validation and detection
- Inventory Cisco Intersight Virtual Appliance deployments and versions.
- Confirm whether version 1.1.4-0 is present.
- Review users with maintenance-shell or administrative access.
- Check whether administrative access is logged and monitored.
- Track remediation status against Cisco’s published advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-20092 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N0.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- cisco-sa-intersight-privesc-p6tBm6jkCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.