Cisco SSM On-Prem RCE (CVE-2026-20160)

Overview

A critical vulnerability, tracked as CVE-2026-20160, has been identified in Cisco Smart Software Manager On-Prem (SSM On-Prem). This flaw allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected appliance with the highest level of privileges.

Vulnerability Details

The vulnerability stems from the unintentional exposure of an internal service. This service’s API is accessible over the network without requiring any form of authentication. By sending a specially crafted request to this exposed API, an attacker can trigger the execution of operating system commands. The CVSS v3.1 base score of 9.8 reflects the severe nature of this flaw: it is remotely exploitable (NETWORK), requires no user interaction (NONE), and needs no prior privileges (NONE).

Impact

Successful exploitation grants an attacker root-level command execution on the host running Cisco SSM On-Prem. This level of access provides a complete foothold within a network, enabling data theft, deployment of ransomware or other malware, lateral movement to other systems, and persistent backdoor access. Given that SSM On-Prem is used for managing software licenses and updates across an organization’s Cisco estate, a compromise could have cascading security implications.

Remediation and Mitigation

Cisco has released software updates that address this vulnerability. Affected users must upgrade to a fixed version of Cisco Smart Software Manager On-Prem immediately. There are no workarounds that address this vulnerability, making patching the only complete solution.

Until patches can be applied, organizations should ensure that access to the SSM On-Prem appliance is restricted at the network level. Implement strict firewall rules or access control lists (ACLs) to permit management access only from trusted, necessary administrative networks and block all other inbound traffic to the appliance’s management interfaces.

Security Insight

This incident highlights the persistent risk of “internal” services being inadvertently exposed to untrusted networks, a recurring theme in enterprise software. Similar to the recent exploitation of a Cisco FMC zero-day by ransomware groups, as seen with CVE-2026-20131, critical network management tools are high-value targets for attackers seeking deep network access. The pattern underscores the necessity for vendors to adopt stricter default configurations and for organizations to treat all management interfaces as high-risk assets requiring layered defense.

Further Reading

• CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zer…
• Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026…
• DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for F…
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs