Smart Software Manager On PremApplication · Cisco
CVE-2026-20160
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThis vulnerability in Cisco Smart Software Manager On-Prem exposes an internal service API to unauthenticated remote attackers, allowing them to send crafted requests that result in arbitrary operating system command execution with root-level privileges.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Smart Software Manager On PremApplication
>= 9-202502, < 9-202601CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Cisco SSM On-Prem versionLocate the version of Cisco Smart Software Manager On Prem installed in your environment. This is typically found in the product UI under 'About' or 'System Information', or via the command line interface if available. Compare your version against the affected range: 9-202502 and above, but below 9-202601.Affected if Your installed version falls within >= 9-202502 and < 9-202601.
-
Determine network exposure of internal serviceIdentify all network interfaces and firewall rules that expose the Cisco SSM On-Prem system. Map which ports and IP addresses are reachable from external or untrusted networks. The vulnerable internal service should not be exposed to untrusted networks.Affected if The internal service on this system is reachable from networks outside the trusted administrative zone.
-
Check for accessible unauthenticated API endpointsProbe the system for web API endpoints that should be internal but are responding to requests. Attempt to access common internal API paths (such as /api/internal/ or similar endpoints) from an untrusted network location without providing credentials.Affected if Internal API endpoints respond to unauthenticated requests from untrusted networks.
-
Inspect running processes and listening portsReview the list of processes running on the Cisco SSM On-Prem system and identify any unexpected or unfamiliar processes. Use system utilities (such as netstat, ss, or similar) to list all listening network ports and identify any unknown services.Affected if Unexpected processes are running or unknown services are listening on ports not documented in the product configuration.
-
Review application and system logs for suspicious API activityExamine Cisco SSM On-Prem application logs, web server logs, and system authentication logs for entries containing unusual API calls, unexpected command executions, or authentication failures from unexpected sources.Affected if Logs contain API requests or command executions that originate from untrusted sources or show patterns inconsistent with normal administrative activity.
Your environment is affected if Cisco SSM On-Prem version 9-202502 through 9-202600 is running AND the internal unauthenticated API service is accessible from untrusted networks, or if logs show evidence of unauthorized API access.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped9-202601
Apply the vendor patch when available. In the interim, implement network segmentation and firewall rules to restrict access to the exposed internal service API.
9-202601 or later
- Identify the current installed version of Cisco Smart Software Manager On-Prem by accessing the administration console or running system commands
- Schedule a maintenance window for the upgrade to minimize business impact
- Obtain the fixed version (9-202601 or later) from the Cisco Software Download center using valid Cisco credentials
- Follow Cisco's official upgrade documentation for SSM On-Prem, typically found in the product documentation or release notes
- Execute the upgrade process according to the provided documentation, ensuring stable power and network connectivity
- After upgrade completion, verify the system is functioning normally and the new version is installed
- Confirm the vulnerability is remediated by reviewing system logs and potentially running vulnerability scans if available
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Smart Software Manager On Prem
Scoped from the published advisory
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-20160 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-20160 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data