CVE-2026-20160 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM… | CVSS 9.8 CRITICAL

Description

A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.

Metadata

CVE ID: CVE-2026-20160
State: PUBLISHED
Assigner: cisco
Reserved: 2025-10-08 11:59 UTC
Published: 2026-04-01 16:29 UTC
Last updated: 2026-04-02 03:56 UTC
Primary CWE: CWE-668
Exposure of Resource to Wrong Sphere
Vendor / Product: Cisco / Cisco Smart Software Manager On-Prem
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco Smart Software Manager On-Prem	—	9-202502, 9-202504, 9-202507, 9-202510

Weakness (CWE)

CWE	Source	Description
CWE-668	cna	Exposure of Resource to Wrong Sphere

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

cisco-sa-ssm-cli-execution-cHUcWuNr https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr