ZDI-26-719: Cisco ThousandEyes Virtual Appliance DHCP Client Command Injection Remote Code Execution Vulnerability
ZDI discloses an authenticated DHCP command-injection RCE in Cisco ThousandEyes, CVE-2026-20350, CVSS 7.2.
The Zero Day Initiative published ZDI-26-719, a command-injection vulnerability in the DHCP client of Cisco ThousandEyes Virtual Appliance. An authenticated remote attacker can execute arbitrary code on affected installations. ZDI assigned CVSS 7.2, and the issue is tracked as CVE-2026-20350. The advisory does not report active exploitation.
- Flaw is in the ThousandEyes Virtual Appliance DHCP client.
- Exploitation requires authentication; ZDI CVSS score is 7.2.
- Impact is remote arbitrary code execution on affected appliances.
- The advisory does not report in-the-wild exploitation.
- CVEs
- CVE-2026-20350
- Vendors
- Cisco
- Products
- ThousandEyes Virtual Appliance
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20350 | RCE in Cisco ThousandEyes Virtual Appliance Management Interface 2026-20350 | 4.7 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco ThousandEyes Virtual Appliance. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.