Read the docs
TI-2019-09441 Aliases CVE-2019-12645GHSA-5m68-8fj2-cw42

Cisco Jabber Client Framework for Mac Code Execution Vulnerability

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to execute arbitrary code on an affected device The vulnerability is due to improper file level permissions on an affected device when it is running Cisco JCF for Mac Software. An attacker could exploit this vulnerability by authenticating to the affected device and executing arbitrary code or potentially modifying certain configuration files. A successful exploit could allow the attacker to execute arbitrary code or modify certain configuration files on the device using the privileges of the installed Cisco JCF for Mac Software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed Cisco Jabber for Mac (Cisco): 12.6(1)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Jabber for Macbefore 12.6(1)12.6(1)Patch availableCNA
  • Cisco Jabber for Mac VendorCisco Affected before 12.6(1) Fixed in 12.6(1) Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:*before 12.6\(1\)VulnerableCisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:* Versions before 12.6\(1\) Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Jabber for Mac (Cisco) Fixed in 12.6(1)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12645
  2. 2026-10-03 Alias added: GHSA-5m68-8fj2-cw42

References

Advisory 1

  • TI-2020-03041 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2020-15937 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-02979 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-01198 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2021-01138 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-16496 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences