A high-severity vulnerability in Cisco’s Webex app could enable attackers to remotely run malicious code on a victim’s system via a meeting invite link. The company released emergency patches for the critical flaw, dubbed CVE-2025-20236, for impacted platform versions.
The vulnerability, which was assigned a high CVSS score of 8.8, persists in Cisco Webex App’s custom URL parser component. It facilitates the delivery and execution of arbitrary codes on target devices.
The CVSS vector string for the flaw displayed that the exploitation method requires the user to interact, resulting in a complete compromise of confidentiality, availability and integrity. Cisco said that the deficiency is caused by “insufficient input validation when Cisco Webex App processes a meeting invite link,” in a security advisory.
When an unsuspecting individual clicks on the specially crafted meeting link, the flawed Webex client processes the action with improper validation, leading to the download of arbitrary files. When the files are downloaded through the meeting link, commands can be run without any further authorisation. The remote code execution allowed by the vulnerable client abuses the user’s privileges.
It was identified during Cisco’s internal security testing and patched before threat actors could abuse the vulnerability in the wild. Cisco Webex App Desktop versions, 44.6.0.29928 to 44.7.0.30285, were impacted while it did not affect versions 44.5 and earlier, along with 44.8 and later.
Cisco released security patches to mitigate the vulnerability, which required users running 44.6 to upgrade to 44.6.2.30589 or a later version to patch the flaw. A direct patch for users on 44.7 was not release,d and the company advised upgrading to a fixed release. They further stated that no workarounds are available for the vulnerability,y and installing the patch or a fixed release was the only effective method.
Cisco Product Security Incident Response Team (PSIRT) said that they are “not aware of any public announcements or malicious use of the vulnerability”. Cybersecurity professionals warned that exploitation and weaponisation is more likely after it has been publicly disclosed. The high CVSS score indicates that organisations should patch the deficiency in the software as soon as possible to avoid disruptions due to the widespread use of Webex in corporate systems.
In the News: European diplomats’ wine-tasting invite turns into a malware-laden nightmare
