Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability

mediumCVE-2026-20161

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system of an affected device. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system. A successful exploit could allow the attacker to bypass file system permissions and overwrite arbitrary files on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-agentfilewrite-tqUw3SMU Security Impact Rating: Medium CVE: CVE-2026-20161

CSIRTS triage

vendor: Cisco product: ThousandEyes Enterprise Agent Privilege escalation

What: A vulnerability in the CLI could allow an authenticated, local attacker to overwrite arbitrary files.
Who is affected: Authenticated local users with low privileges on affected devices.
Urgency: Remediation is necessary as it allows file system permission bypass.
Action: Update to the latest software version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch ThousandEyes Enterprise Agent

Get an email when a new ThousandEyes Enterprise Agent advisory drops — max one per day, one-click unsubscribe.

Details

Source: Cisco Security Advisories (INTL · vendor-psirt · site)
Severity: medium
Published: 2026-04-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-agentfilewrite-tqUw3SMU?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20ThousandEyes%20Enterprise%20Agent%20Arbitrary%20File%20Overwrite%20Vulnerability%26vs_k=1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-201610.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20161	coverage & exploitation status	NVD · CVE.org

Recent advisories for Cisco ThousandEyes Enterprise

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCisco ThousandEyes Enterprise Agent BrowserBot Command Injection Vulnerabilitycisco-psirt · 2026-05-20