Summaryinfo

A vulnerability was found in Cisco Evolved Programmable Network Manager up to 8.1.1. It has been classified as critical. The affected element is an unknown function of the component REST API Endpoint. Performing a manipulation results in authorization. This vulnerability was named CVE-2026-20155. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Cisco Evolved Programmable Network Manager up to 8.1.1. It has been classified as critical. This affects an unknown code block of the component REST API Endpoint. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access. This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2026-20155 since 10/08/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/01/2026).

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• Evolved Programmable Network Manager

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.2.1
• 7.1.3
• 7.1.3.1
• 7.1.4
• 7.1.4.1
• 8.0.0
• 8.0.0.1
• 8.0.1
• 8.0.1.1
• 8.1.0
• 8.1.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion