Read the docs
TI-2019-01315 Aliases CVE-2019-1689GHSA-rg62-gwr6-wv2q

Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01574 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Cisco Webex Teams (Cisco): 3.13.26920

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Webex Teamsbefore 3.13.269203.13.26920Patch availableCNA
  • Cisco Webex Teams VendorCisco Affected before 3.13.26920 Fixed in 3.13.26920 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:iphone_os:*before 3.13.26920VulnerableCisco
  • cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:iphone_os:* Versions before 3.13.26920 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Webex Teams (Cisco) Fixed in 3.13.26920

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1689
  2. 2026-10-03 Alias added: GHSA-rg62-gwr6-wv2q

References

Exploit 1

  • TI-2019-01262 Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability CVSS 3.0HIGH 7.8
  • TI-2019-01559 Cisco Webex Teams Logging Feature Command Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2018-00346 Improper input validation in Cisco Webex Teams unknown CVSS 3.1HIGH 8.8
  • TI-2025-14536 Cisco Webex App Client-Side Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2018-00395 Cisco Webex Teams Information Disclosure and Modification Vulnerability CVSS 3.1HIGH 8.7
  • TI-2020-03080 Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability CVSS 3.1HIGH 8.4
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences