CVE-2026-20156 is a high severity grouped CVE (CVSS 8.1) for improper restriction of operations within memory buffer bounds in Cisco RoomOS. Cisco found the issues in an internal review and fixed them in a July 2026 hardening release. Check the advisory for fixed versions and update.
What's affected
Cisco RoomOS and RoomOS Cloud are named in the record. Cisco's advisory, cisco-sa-hardening-roomos-AqNMbEq, says the issues were found during internal testing and are not known to be actively exploited. It also says there are no workarounds, and that Cisco has released software updates.
The record does not give version numbers. The advisory has them.
How to check if you're exposed
Open the device's settings or the Control Hub to read the RoomOS version of each room device, then compare it with the fixed releases in Cisco's advisory.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- List Cisco RoomOS devices and their software versions.
- Read the Cisco advisory and note the fixed release for your device family.
- Upgrade the devices through Control Hub or your device management tool.
- Keep room devices on a management network with restricted inbound access.
Why it matters
Cisco grouped several internally found issues by weakness class and gave each class one CVE. This one is the CWE-119 pillar, improper restriction of operations within the bounds of a memory buffer. Memory bounds bugs can lead to crashes or code execution, and the record's vector shows high impact on all three of confidentiality, integrity and availability, at high attack complexity.
The advisory covers five other CVEs too, including CVE-2026-20157. One update addresses the set. The CVE is not in CISA's KEV list.
Quick check
Is this being exploited?
Cisco says the issues were found internally and are not known to be actively exploited. The CVE is not in KEV.
Is there a workaround?
Cisco says no. Update.
Sources
Last reviewed: 19 October 2026.
