Privilege Escalation Vulnerability in Cisco Smart Software Manager On-Prem

CVE-2026-20151

What is CVE-2026-20151?

A vulnerability exists in the web interface of Cisco Smart Software Manager On-Prem that enables an authenticated, remote attacker to elevate their privileges. By exploiting improper transmission of sensitive user data, attackers can send crafted messages to an affected Cisco SSM On-Prem host, retrieving session credentials from the status messages. This allows them to gain higher privileges on the system, compromising sensitive user accounts that are currently logged in via the web interface. Users logged in through SSH are not affected by this issue.

References