ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability
ZDI discloses an authenticated DHCP command-injection RCE in Cisco ThousandEyes, CVE-2026-20350, CVSS 7.2.
The Zero Day Initiative published ZDI-26-719, a command-injection vulnerability in the DHCP client of Cisco ThousandEyes Virtual Appliance. An authenticated remote attacker can execute arbitrary code on affected installations. ZDI assigned CVSS 7.2, and the issue is tracked as CVE-2026-20350. The advisory does not report active exploitation.
- Flaw is in the ThousandEyes Virtual Appliance DHCP client.
- Exploitation requires authentication; ZDI CVSS score is 7.2.
- Impact is remote arbitrary code execution on affected appliances.
- The advisory does not report in-the-wild exploitation.
Vulnerabilities mentionedAll →
- CVE-2026-203504.7—RCE in Cisco ThousandEyes Virtual Appliance Management Interface 2026-20350published · Cisco ThousandEyes Virtual Appliance
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20350 | RCE in Cisco ThousandEyes Virtual Appliance Management Interface 2026-20350 A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance allows an authenticated, remote attacker to inject arbitrary operating system commands. The flaw stems from improper validation of user-supplied input, enabling attackers to save malicious configuration values and execute arbitrary OS commands with root privileges. This requires valid administrative credentials. The affected product is Cisco ThousandEyes Virtual Appliance, with no known public exploit or fixed versions currently in the data. Do: Upgrade to latest versions of Cisco ThousandEyes Virtual Appliance; enable network-level controls and input validation checks; monitor for unauthorized management access and configure robust authentication and access controls. |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco ThousandEyes Virtual Appliance. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20350.
This source does not provide full text. Read it at zerodayinitiative.com.