Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability
A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker. This vulnerability is due to an incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials could exploit this vulnerability by sending crafted network traffic to an affected device. A successful exploit could allow the attacker to inherit the firewall rules associated with a different user in the system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ts-agent-fw-bypass-MYBTMrev Security Impact Rating: Medium CVE: CVE-2026-20028
CSIRTS triage
- What
- A network driver vulnerability allows authenticated remote attackers to bypass firewall rules by sending crafted network traffic that exploits incorrect mapping of network connections to user accounts.
- Who is affected
- Deployments of Cisco Terminal Services Agent with affected network driver versions.
- Urgency
- Medium priority; requires authentication but allows privilege escalation through firewall rule inheritance without known exploitation in the wild.
- Action
- Apply the latest software updates from Cisco as referenced in advisory cisco-sa-ts-agent-fw-bypass-MYBTMrev.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Terminal Services Agent
Get an email when a new Terminal Services Agent advisory drops — max one per day, one-click unsubscribe.
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-200280.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20028 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for Cisco Terminal Services
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from Cisco Security Advisories
- criticalCisco Advance Notification for Publication of August 5, 2026, Security Advisories2026-08-05
- mediumCisco Catalyst SD-WAN Manager Information Disclosure Vulnerability2026-08-05
- highCisco Integrated Management Controller Argument Injection Vulnerabilities2026-08-05
- mediumCisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability2026-08-05
- mediumCisco RoomOS Logging Subsystem Information Disclosure Vulnerability2026-08-05