Platform
cisco
Component
thousandeyes-enterprise-agent
Fixed in
5.0.1
4.4.5
4.4.4
4.4.3
4.2.1
4.1.1
4.0.1
5.1.1
5.1.3
CVE-2026-20161 describes an arbitrary file access vulnerability within the Command Line Interface (CLI) of Cisco ThousandEyes Enterprise Agent. This flaw allows an authenticated, local attacker with low privileges to overwrite files on the affected device, potentially leading to system compromise or data corruption. The vulnerability impacts versions 4.0 through 5.1.2 and a fix is expected to be released by Cisco.
Successful exploitation of CVE-2026-20161 allows a local attacker to bypass file system permissions and overwrite arbitrary files on the affected Cisco ThousandEyes Enterprise Agent. This could involve modifying critical system files, injecting malicious code, or disrupting normal operations. The attacker needs to be authenticated and present on the device, but low privileges are sufficient. The potential impact ranges from denial of service to complete system takeover, depending on the files overwritten and the attacker's subsequent actions. While the vulnerability requires local access, the widespread deployment of ThousandEyes agents across networks increases the potential attack surface.
CVE-2026-20161 was publicly disclosed on April 15, 2026. As of this date, there are no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA KEV catalog. The EPSS score is pending evaluation, but the requirement for local authentication suggests a medium probability of exploitation.
Exploit Status
EPSS
0.01% (2% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-20161 is to upgrade to a patched version of Cisco ThousandEyes Enterprise Agent as soon as it becomes available. Until a patch is applied, consider restricting access to the CLI and implementing strict file system permissions. Monitoring file system integrity for unexpected modifications is also recommended. While a direct workaround is not available, careful access control and regular security audits can reduce the risk. After upgrading, verify the fix by attempting to create a symbolic link in the vulnerable location and confirming that the file overwrite is prevented.
Cisco recommends updating to a corrected version of the ThousandEyes Enterprise agent. See the Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-agentfilewrite-tqUw3SMU) for more details on affected versions and available corrected versions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-20161 is a medium-severity vulnerability in Cisco ThousandEyes Enterprise Agent versions 4.0 through 5.1.2 that allows an authenticated, local attacker to overwrite arbitrary files.
If you are running Cisco ThousandEyes Enterprise Agent versions 4.0 through 5.1.2, you are potentially affected by this vulnerability. Check your deployed versions against the affected range.
The recommended fix is to upgrade to a patched version of Cisco ThousandEyes Enterprise Agent as soon as it becomes available. Monitor Cisco's security advisories for updates.
As of April 15, 2026, there are no known public exploits or active campaigns targeting CVE-2026-20161.
Refer to the official Cisco Security Advisory for CVE-2026-20161 on the Cisco website (search for CVE-2026-20161 on Cisco.com).
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.