Loading story…
Cisco disclosed two vulnerabilities affecting Cisco Smart Software Manager On-Prem: one that allows arbitrary command execution and another that enables privilege escalation. The issues were published as separate Cisco security advisories and affect the on-premises software management platform used to manage Cisco licenses and entitlements within enterprise environments.
Together, the flaws raise the risk that an attacker could execute commands on a vulnerable appliance and gain elevated privileges, increasing the potential impact on systems running the product. Organizations using Cisco Smart Software Manager On-Prem should review the relevant Cisco advisories, determine exposure in their deployments, and prioritize vendor-recommended remediation to reduce the risk of compromise.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Cisco released fixes for CVE-2026-20093, a critical Integrated Management Controller vulnerability that could allow an unauthenticated remote attacker to bypass authentication, change user passwords, and gain elevated access. Cisco said there was no evidence of in-the-wild exploitation and that no workaround was available.
Cisco published a separate security advisory for a privilege escalation vulnerability affecting Cisco Smart Software Manager On-Prem. The advisory was released on 2026-01-04.
Cisco published a security advisory for an arbitrary command execution vulnerability affecting Cisco Smart Software Manager On-Prem. The advisory was released on 2026-01-04.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
Cisco disclosed command injection and remote code execution vulnerabilities affecting **Cisco Integrated Management Controller (CIMC)**, warning that the flaws could allow an attacker to execute arbitrary commands or code on impacted systems. The advisory identifies the issue as affecting CIMC and frames it as a serious compromise path into server management infrastructure, where successful exploitation could give an attacker control over administrative functions and underlying devices. The vulnerabilities were published in a Cisco security advisory under the topic **"Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities."** Organizations using Cisco CIMC are expected to review the vendor advisory, determine whether exposed or internet-reachable management interfaces are affected, and apply Cisco-provided fixes or mitigations to reduce the risk of unauthorized command execution on management controllers.
Jun 29, 2026
Cisco disclosed a critical command injection flaw in **Cisco Catalyst SD-WAN Manager** (`CVE-2026-20245`) that is being actively exploited in the wild, allowing an authenticated local attacker with `netadmin` privileges to execute arbitrary commands as `root`. The vulnerability is caused by insufficient validation of file-transfer payloads in the CLI, and Cisco said observed exploitation has already resulted in unauthorized configuration changes being pushed from the manager to edge devices, raising the risk of broader network compromise in affected SD-WAN environments. Cisco also warned the issue could be chained with the previously disclosed authenticated privilege-escalation bug `CVE-2026-20182` to obtain the required access level before triggering command execution. At the time of disclosure, no standard software fix was available; administrators were advised to review logs, inspect `scripts.log` for suspicious activity, and work with Cisco Technical Assistance Center for mitigations and workarounds while assessing whether managed edge infrastructure had been altered.
Aug 15, 2026