cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Cisco Patches Critical and High-Severity Flaws Affecting Enterprise Products

· Original article ↗

Summary

Cisco patched eight critical and high-severity vulnerabilities affecting products including SSM On-Prem, EPNM, and IMC. The flaws could enable command execution, authentication bypass, privilege escalation, or information disclosure; Cisco reports no known exploitation.

Key points

  • CVE-2026-20160 affects Cisco Smart Software Manager On-Prem and could allow command execution with root privileges through an exposed internal service.
  • CVE-2026-20093 could let an unauthenticated attacker change user passwords, including administrator passwords, and access a vulnerable device as an administrator.
  • A high-severity Evolved Programmable Network Manager flaw could expose sensitive information; another SSM On-Prem flaw could enable privilege escalation.
  • Four Integrated Management Controller vulnerabilities could allow arbitrary command execution and root access due to improper validation of user-supplied input.
  • More than two dozen enterprise networking products are affected by the IMC flaws, including UCS C-series and E-series servers and related appliances.
  • Cisco says it is unaware of exploitation of the vulnerabilities in the wild.

Article Details

Vulnerability Types
  • Authentication bypass
  • Remote code execution
  • Privilege escalation
  • Information disclosure
Severity
Critical and high
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-20093Cisco · Cisco Enterprise NFV Infrastructure Software; Cisco · Cisco Unified Computing System (Standalone); +1 moreThe second critical flaw is CVE-2026-20093, an authentication bypass issue rooted in the incorrect handling of password change requests.CVE-2026-20160Cisco · Cisco Smart Software Manager On-PremOne of the critical bugs, tracked as CVE-2026-20160, impacts Cisco Smart Software Manager On-Prem (SSM On-Prem) and could allow attackers to abuse an erroneously exposed internal service to execute arbitrary commands.

Vendors

CiscoCisco on Wednesday announced fixes for two critical and six high-severity vulnerabilities that could be exploited for authentication bypass, remote code execution, privilege escalation, and information disclosure.

Products

Cisco Smart Software Manager On-Prem (SSM On-Prem)One of the critical bugs, tracked as CVE-2026-20160, impacts Cisco Smart Software Manager On-Prem (SSM On-Prem) and could allow attackers to abuse an erroneously exposed internal service to execute arbitrary commands.E-series serversAccording to Cisco, more than two dozen enterprise networking products are impacted by the four security defects, including UCS C-series and E-series servers, as well as appliances that are based on them.Evolved Programmable Network Manager (EPNM)On Wednesday, Cisco patched a high-severity defect in Evolved Programmable Network Manager (EPNM) that could allow attackers to access sensitive information, and another in SSM On-Prem that could be exploited forIntegrated Management Controller (IMC)The company also rolled out fixes for four Integrated Management Controller (IMC) vulnerabilities that could be exploited to execute arbitrary commands and gain root privileges.UCS C-SeriesAccording to Cisco, more than two dozen enterprise networking products are impacted by the four security defects, including UCS C-series and E-series servers, as well as appliances that are based on them.

Related Articles