High

Cisco has disclosed a critical security vulnerability in its cloud-based Webex Services, tracked as CVE-2026-20184, with a CVSS score of high, indicating maximum severity. The flaw affects organizations using Single Sign-On (SSO) integration within the Webex Control Hub. It enables a remote, unauthenticated attacker to bypass authentication controls entirely and impersonate any legitimate user on the platform, posing a severe risk to enterprise environments that rely on Webex for communication and collaboration.

The root cause of the vulnerability is identified as improper certificate validation in the SSO authentication process (CWE-295). Specifically, when Webex integrates with an Identity Provider (IdP) for SSO, it fails to properly validate security certificates associated with authentication requests. This weakness allows attackers to craft malicious authentication tokens that are incorrectly accepted as legitimate by the system, effectively breaking the trust model of the SSO implementation.

The exploitation process is relatively straightforward. An attacker can directly target a vulnerable Webex endpoint, submit a specially crafted authentication token, and exploit the flawed validation mechanism. Once the system accepts the malicious token, the attacker is granted immediate unauthorized access and can fully impersonate the targeted user account. This level of access could potentially expose sensitive corporate communications, internal meetings, and confidential organizational data.

Although Cisco has already implemented backend fixes for its cloud infrastructure and confirmed no known active exploitation in the wild, the risk remains extremely high due to the nature of the flaw. There are currently no temporary workarounds available, making manual mitigation essential. Cisco advises affected organizations to immediately upload updated SAML certificates for their Identity Provider (IdP) in Webex Control Hub. Failure to do so may leave systems exposed to impersonation attacks and service disruptions, despite the absence of current real-world exploitation.