CVE-2026-20160 in Smart Software Manager On-Prem
Summary
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host.
This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Responsible
cisco
Reservation
10/08/2025
Disclosure
04/01/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354715 | Cisco Smart Software Manager On-Prem API exposure of resource | 668 | Not defined | Official fix | CVE-2026-20160 |