SECUFOCUSNOW
Home›CVE index›CVE-2026-20151
Review reviewHigh

CVE-2026-20151

Cisco Cisco Smart Software Manager On-Prem, smart software manager on-prem

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative. To exploit this vulnerability,...

CVSS
7.3
EPSS
0.27%
19.1% percentile
CISA KEV
Not listed
Published
2026.04.02
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.27%
Technical severityCVSS 7.3

Vulnerability overview

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative. To exploit this vulnerability,...

Affected product and versions

Product
Cisco Cisco Smart Software Manager On-Prem, smart software manager on-prem
Affected versions
7-202001, 8-202004, 8-202006, 8-202012, 8-202010, 8-202008, 9-202201, 8-202102, 8-202105, 8-202108, 8-202112, 8-202201, 8-202206, 8-202212, 8-202302, 8-202303, 8-202304, 8-202308, 8-202401, 8-202404
Fixed versions
9-202601

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Cisco Cisco Smart Software Manager On-Prem, smart software manager on-prem and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE
CWE-201