CVE-2026-20155 in Cisco Evolved Programmable Network Manager
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access.
This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Responsible
cisco
Reservation
10/08/2025
Disclosure
04/01/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354723 | Cisco Evolved Programmable Network Manager REST API Endpoint authorization | 862 | Not defined | Official fix | CVE-2026-20155 |