CVE-2026-20160
Published: 01 April 2026
Description
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. This vulnerability is due to the unintentional exposure of…
more
an internal service. An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the specific vulnerability exposing the internal service, preventing unauthenticated remote command execution.
Enforces boundary protection via firewalls and network segmentation to block remote access to the exposed internal service API.
Limits system to least functionality by prohibiting or restricting unnecessary internal services that could be unintentionally exposed remotely.
Security SummaryAI
CVE-2026-20160 is a high-severity vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) that exposes an internal service, enabling an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SSM On-Prem host. The issue stems from the unintentional exposure of this service, which allows attackers to target its API. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-668 (Exposure of Resource to Wrong Sphere).
An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted request to the API of the exposed internal service. Successful exploitation grants root-level privileges on the underlying operating system, potentially allowing full compromise of the SSM On-Prem host, including data exfiltration, persistence, or further lateral movement within the network.
The Cisco Security Advisory provides details on mitigation, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability exposes an internal service API allowing unauthenticated remote arbitrary command execution with root privileges, directly enabling exploitation of a public-facing application.