Cisco Webex vulnerabilities

10 CVEs affecting Cisco Webex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20149, published 2026-03-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-3823, published 2017-02-01. High severity, CVSS 8.8. EPSS: 27.2% chance of exploitation in the next 30 days. An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control…
CVE-2009-2880, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.2% chance of exploitation in the next 30 days. Buffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for…
CVE-2009-2878, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac…
CVE-2009-2876, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac…
CVE-2009-2879, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 (aka T26SP49EP32) for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac…
CVE-2009-2877, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x (aka T27SP10) for Windows, 26.x before 26.49.35 for Mac OS X and Linux,…
CVE-2009-2875, published 2009-12-18. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x before 26.49.32 for Windows, 27.x before 27.10.x for Windows, 26.x before 26.49.35 for Mac OS X and Linux, and 27.x before 27.11.8 for…
CVE-2013-3425, published 2013-07-31. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a file exists, which allows remote authenticated users to…
CVE-2012-6399, published 2013-05-27. Medium severity, CVSS 5.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2026-20149, published 2026-03-04. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in Cisco Webex could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability, and no customer action is…