CVE-2026-20028 is a logic bug in Cisco's TS Agent network driver, not a memory corruption issue. The driver incorrectly maps incoming traffic to user session contexts, allowing an attacker with valid credentials to inherit another user's firewall rules through crafted traffic injection.
This is a translation layer failure. Session identity exists at the TS session layer, but packets carry no session tokens. Somewhere in that mapping logic, the driver associates traffic with the wrong account. An attacker doesn't need to escalate privileges — they need to be authenticated, which in a TS environment with per-user firewall rules means hundreds of legitimate employees already meet that threshold.
The practical impact: if your TS deployment uses per-user firewall rules to segment Finance from Engineering, an attacker in the Finance segment can potentially access destinations Engineering's rules permit. The CVSS 5 score is defensible by the metric — you need authentication, and the direct impact is rule inheritance rather than data theft. But that scoring framework doesn't account for environments where per-user segmentation is a compliance boundary. If your audit framework assumes User A cannot see User B's network posture, this vulnerability breaks that assumption without any privilege escalation.
The attack window centers on state transitions — reconnection events, session resuming — where the mapping logic is most prone to error. An attacker doesn't need a polished exploit; they need to be present during a state transition with crafted traffic.
Defenders should verify TS Agent version against Cisco's advisory and implement compensating controls: segmentation enforcement at the network layer that doesn't depend on TS Agent session mapping, and logging of traffic classification events to detect anomalous rule application. The authentication requirement is not a meaningful barrier — it's the baseline state of the system being exploited.