Cisco Jabber Desktop and Mobile Client Software Vulnerabilities

published 2021-03-24 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-6938

cvss: 9.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Patch / fix

fixed in 1

cisco jabber 12.1.5, 12.5.4, 12.6.5, 12.7.4, 12.8.5, 12.8.7, 12.9.5, 12.9.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-11-08)

Exploit prediction

1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Cisco Cisco Jabber

Classification

Weakness

CWE-170 Improper Null Termination
CWE-295 Improper Certificate Validation

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC
vendor-advisory

Sources

CVE List CVE-2021-1471
NVD CVE-2021-1471

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary