CVE-2026-101886

Executive Summary

CVE-2026-101886 is a path traversal vulnerability in Cisco Jabber for Android (package com.cisco.im) affecting versions before 15.3.1.311364. The flaw allows a malicious Android application with no declared permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name obtained from a ContentProvider, which is then used in file path construction. Successful exploitation enables an attacker to place arbitrarily controlled content into sensitive internal directories such as databases/, shared_prefs/, no_backup/, and files/ without any user interaction, undermining the application's private storage integrity.

Technical Analysis

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal). The core technical mechanism, as described in the NVD entry, involves two interacting weaknesses:

1. Exported activity surface. Cisco Jabber for Android exposes an activity identified as crosslaunch.share. Because this activity is exported, it can be invoked by any other application installed on the same device—regardless of whether that application holds any Android permissions (PR:N in the CVSS vector). This constitutes the primary attack surface and explains the local attack vector (AV:L).

2. Unsanitized display name used in path construction. The activity consumes data from a ContentProvider, from which it reads a display name. This display name is not sanitized before being incorporated into a file path. By supplying a display name containing ../ traversal sequences, an attacker can escape the intended destination directory and cause files to be written into Jabber's private data directory.

The resulting arbitrary file write is constrained to locations reachable by the Jabber process's own file permissions—hence the confidentiality impact is N (None) and the integrity impact is L (Low) under the CVSS 3.1 vector (C:N/I:L/A:N). The ../ sequences allow an attacker to place fully attacker-controlled content into directories including databases/, shared_prefs/, no_backup/, and files/.

The UI:N component indicates that no user interaction is required for the file write to occur—the malicious app simply needs to be present and be able to invoke the exported activity. The S:U (Scope: Unchanged) reflects that the impact remains within Jabber's own security authority.

It is important to note that this is not a remote network attack. It requires a malicious application to be installed on the same Android device as the affected Cisco Jabber client. The absence of required permissions on the attacker app is the notable escalation of impact: an app the user might consider "harmless" (no permission prompts) can still corrupt Jabber's private data store.

Technical detail caveat: The NVD description does not disclose the specific class or function names involved in file writing, nor the exact parameter names of the ContentProvider. Those implementation specifics are not available and are not fabricated here. The above analysis is strictly derived from the stated behavior: exported activity + unsanitized display name + path traversal + private data directory write.

Exploitation Scenarios

The attack chain for CVE-2026-101886 proceeds at the vulnerability-class level, constrained strictly to the details provided:

1. Reconnaissance / target identification. The attacker must identify devices where the vulnerable Cisco Jabber for Android (com.cisco.im) version (< 15.3.1.311364) is installed. Because the attack is local, the malicious app is delivered via a conventional Android distribution channel—either a sideloaded APK or a trojanized application on a third-party store. The attacker app inspects for the presence of the Jabber package and its exported crosslaunch.share activity.

2. Triggering the flaw. The malicious app constructs a shared content:// URI and invokes the exported crosslaunch.share activity. Within the data supplied to the activity—specifically the display name field sourced from the ContentProvider—the attacker embeds ../ path traversal sequences. Because the display name is used unsanitized in file path construction, the traversal sequence redirects the write target outside the intended directory.

3. Payload / execution method. The attacker supplies fully attacker-controlled file content. The traversal places this content into Jabber's private data directory, with the description explicitly naming databases/, shared_prefs/, no_backup/, and files/ as reachable destinations. No user interaction is required, and the malicious app requires no Android permissions to perform the write. No public PoC or exploit code is available; the attack chain described here is inferred from the vulnerability class and the NVD description.

4. Post-exploitation impact. By planting attacker-controlled files in databases/, shared_prefs/, or files/, a malicious app can influence Jabber's stored state, configuration, or cached content. Because the impact rating is integrity-Low only, the primary consequence is corruption or manipulation of Jabber's private data rather than direct code execution or credential exfiltration as described. However, tampering with shared_prefs/ or databases/ could, depending on how Jabber consumes that data, affect application behavior upon next launch.

Out-of-scope note: No evidence of weaponization, exploit-in-the-wild, or threat-actor campaign exists in the provided data (CISA KEV: NO; no PoC; no Nuclei template; EPSS 0.00140, 2.9th percentile). This is currently a low-likelihood, low-severity local issue.

Impact Assessment

• Severity: CVSS 3.1 base score 4.0 (Medium) — vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
• Attack Vector (Local): Requires a malicious app co-installed on the same Android device.
• Attack Complexity (Low): Exploitation does not require specialized conditions or race windows.
• Privileges Required (None): The malicious app needs no Android permissions—this is the key risk characteristic, as it bypasses the permission model users rely on to assess app safety.
• User Interaction (None): No user action required beyond having the malicious app installed.
• Confidentiality (None) / Integrity (Low) / Availability (None): The flaw permits controlled arbitrary file writes within Jabber's private directory; it does not disclose data or cause denial of service per the assigned vector.
• Scope (Unchanged): Impact remains within Jabber's security authority.

Blast radius: Any Android device running Cisco Jabber for Android below version 15.3.1.311364 with a malicious app installed. Enterprise deployments using managed devices with Jabber as the unified communications client are the primary concern, particularly in BYOD environments where users sideload apps from untrusted sources.

Business impact: The primary business risk is integrity compromise of Jabber's local private storage, which could be leveraged to manipulate application state or plant tainted data. Given the Medium severity and lack of demonstrated real-world exploitation, the immediate operational risk is moderate; however, the permission-free attack path makes it a notable hardening concern for mobile fleet security teams.

Detection Guidance

Sigma Rule

title: Cisco Jabber for Android Path Traversal via crosslaunch.share Activity
id: 8d3c1e42-5a7b-4f9e-9c21-6b0f2a1d4e77
status: experimental
description: Detects abuse of the exported crosslaunch.share activity in Cisco Jabber for Android (com.cisco.im) with path traversal sequences in shared content display names.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101886
author: valtersit.com
date: 2026/01/01
logsource:
  product: android
  service: application
detection:
  selection_pkg:
    PackageName|contains: 'com.cisco.im'
  selection_activity:
    Component|contains: 'crosslaunch.share'
  selection_traversal:
    DisplayName|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
  condition: selection_pkg and selection_activity and selection_traversal
falsepositives:
  - Legitimate file shares with dots in display names (rare)
level: medium
tags:
  - attack.t1204
  - cwe.22

YARA Rule

rule Android_Cisco_Jabber_PathTraversal_CVE_2026_101886
{
    meta:
        description = "Detects APKs abusing Cisco Jabber crosslaunch.share activity with path traversal display names"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101886"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pkg      = "com.cisco.im" ascii wide
        $activity = "crosslaunch.share" ascii wide
        $traverse = "../" ascii wide
        $trav2    = "..%2f" ascii wide
        $databases = "databases/" ascii wide
        $sharedpref = "shared_prefs/" ascii wide
        $nobackup = "no_backup/" ascii wide

    condition:
        uint32(0) == 0x04034b50 and
        $pkg and $activity and
        any of ($traverse, $trav2) and
        any of ($databases, $sharedpref, $nobackup)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101886 Cisco Jabber Android Path Traversal Attempt via crosslaunch.share"; flow:established,to_server; http.uri; content:"crosslaunch.share"; nocase; http.uri; content:"../"; nocase; reference:cve,2026-101886; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101886; classtype:attempted-user; sid:2026101886; rev:1;)

Elastic Detection

process where event.action == "start" and
  process.name : "*" and
  process.args : "*crosslaunch.share*" and
  process.args : "*../*" and
  process.args : "*com.cisco.im*"

Splunk SPL Query

index=android_logs sourcetype=android:app
| search "com.cisco.im" AND "crosslaunch.share"
| search "display_name=*../*" OR "uri=*%2e%2e%2f*" OR "path=*../*"
| stats count values(display_name) values(uri) by device_id, dest_app, src_app
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="android,jabber,">
  <rule id="101886" level="8">
    <decoded_as>json</decoded_as>
    <field name="packageName">com\.cisco\.im</field>
    <field name="component">crosslaunch\.share</field>
    <field name="displayName">\.\./|%2e%2e%2f</field>
    <description>CVE-2026-101886: Cisco Jabber for Android path traversal via crosslaunch.share activity with traversal sequence in display name</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cwe_22,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference is available in any tracked source. The affected version threshold is stated as "before 15.3.1.311364" per the NVD description, but no confirmed fixed build or advisory has been published.

1) Immediate mitigations

• Restrict installation of unvetted/sideloaded applications on devices running Cisco Jabber for Android. Enforce Android Enterprise Managed Google Play allowlisting or equivalent app-control policies (e.g., Android Enterprise "block installation of unknown sources").
• Treat any non-allowlisted app on a device that also hosts Cisco Jabber (com.cisco.im) as a potential attacker app. Mobile Threat Defense (MTD) solutions can detect apps that invoke exported Jabber activities.
• Consider isolating Jabber from untrusted apps via Android work profiles so that a personal-profile malicious app cannot invoke work-profile-exposed components.
• Where managed via MDM/EMM, verify and enforce the minimum Android security patch level and application allowlist, but note these do not themselves remediate the Jabber flaw.

2) Patch / upgrade steps

• Monitor Cisco's official security advisories page for an advisory covering Cisco Jabber for Android and for a fixed build at or above 15.3.1.311364.
• Do not assume 15.3.1.311364 is a confirmed patched release; it is the version boundary stated in the NVD description. Confirm the fixed build through Cisco's advisory before remediation planning.
• Stage upgrades through enterprise app distribution (EMM) once a vendor-fixed version is published.

3) Long-term hardening

• Network and device security teams should enforce a policy of "no sideloaded apps" on corporate-managed devices.
• Application developers should sanitize display names and other ContentProvider-sourced strings before path construction and avoid exporting activities unnecessarily; where export is required, apply least-privilege and strict input validation. (This is a general hardening principle for the CWE-22 class, not a statement about Cisco's code.)
• Adopt CWE-22-aware code review for any Android component that uses external strings in file path construction.

References

• NVD — CVE-2026-101886: https://nvd.nist.gov/vuln/detail/CVE-2026-101886
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Cisco Security Advisories (vendor portal — check for published Jabber for Android advisory): https://sec.cloudapps.cisco.com/security/center/publicationListing.x
• FIRST EPSS — CVE-2026-101886 score (0.00140, 2.9th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-101886
• MITRE ATT&CK — T1204 User Execution: https://attack.mitre.org/techniques/T1204/

Exploit-in-the-wild / threat actor evidence: None. CISA KEV status is NO; no public PoC, exploit code, or Nuclei template is available; EPSS is 0.00140 (2.9th percentile).