CVE-2026-20157 is a high severity grouped CVE (CVSS 7.5) for missing encryption in Cisco RoomOS. Cisco found the issues in an internal review and fixed them in a July 2026 hardening release. Check the advisory for fixed versions and update the devices.
What's affected
Cisco RoomOS and RoomOS Cloud are named in the record. Cisco's advisory says the issues were found in internal testing and are not known to be actively exploited, and that no workarounds exist. The record has an adjacent network attack vector, so the attacker would need to be on the same network. Fixed versions are in the advisory.
How to check if you're exposed
Read the RoomOS version of each device in the device settings or in Control Hub, and compare it with the fixed releases in Cisco's advisory.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Inventory RoomOS devices and versions.
- Apply the update named in Cisco's advisory.
- Place room devices on a segmented network so unknown hosts cannot sit adjacent to them.
- Confirm the version after the update.
Why it matters
The weakness class is CWE-311, missing encryption of sensitive data. When data crosses a network or sits on disk unencrypted, anyone with the right position can read or alter it. The vector's high confidentiality and integrity impact, with adjacent access and high complexity, fits that.
It belongs to the same advisory as CVE-2026-20156. The CVE is not in CISA's KEV list.
Quick check
Who can exploit it?
An attacker on the adjacent network, per the vector.
Where are fixed versions?
In Cisco's advisory.
Sources
Last reviewed: 19 October 2026.
