Cisco has issued an urgent security advisory for a critical vulnerability in the Smart Software Manager On-Prem (SSM On-Prem) platform , which organizations use to manage Cisco software licenses on-premises. The flaw is tracked as CVE-2026-20160 and has received a near-maximum CVSS severity score of 9.8/10, indicating a high risk: an unauthorized remote attacker could gain complete control of the affected system.
The nature of vulnerability
The issue results from an internal system service being accidentally exposed, allowing it to be exploited without a username, password, or prior network access. Attackers can trigger the vulnerability by sending a specially crafted request to the exposed service's API.
If successful, the attacker gains root, executing arbitrary commands on the operating system. This means they can steal sensitive data, install ransomware , or move to other protected areas of the corporate network, making the threat immediate and serious.
See also: Claude Code discovered zero-day in Vim and GNU Emacs
Vulnerable and safe versions
The vulnerability affects specific versions of Cisco SSM On-Prem, released in the past year: versions 9-202502 through 9-202510 are vulnerable , while all older versions are considered safe. Cisco has released version 9-202601 , which contains the fix . Organizations should upgrade immediately to avoid the risk. The company confirmed that the Smart Licensing Utility and Smart Software Manager satellite products are not affected .
Current operating status
So far, Cisco has not reported any publicly available exploits or malicious campaigns exploiting the vulnerability. The issue was discovered internally during a technical support call, but now that the details of CVE-2026-20160 have been made public, cybercriminals will likely attempt to reverse-engineer the update and scan for vulnerable systems. Security teams should consider upgrading as a high priority.
See also: TrueConf: Zero-day vulnerability used in attacks on government networks
Risks for businesses and networks
This vulnerability highlights the critical importance of timely update management in environments that handle sensitive business information. An attacker with root access could install malware, collect confidential data, and bypass internal security mechanisms. The full extent of the threat makes it imperative to immediately upgrade and audit all SSM On-Prem systems.
Defense strategy and proposed measures
The only way to protect yourself is to upgrade to version 9-202601. However, before upgrading, IT teams should verify that devices meet the memory and hardware requirements of the new version. In addition, it is recommended to monitor the network for unusual API activity and strengthen identity management for access to Cisco services.
See also: F5 BIG-IP APM: Critical RCE vulnerability used in attacks
The importance of preventive security
The SSM On-Prem incident highlights a key trend in cyberspace: vulnerabilities that are not immediately exploited can quickly become targets once they are made public. Companies must keep all critical systems up to date , incorporate regular auditing processes, and develop security policies that reduce response time to new vulnerabilities.
Cisco warns that organizations that neglect to upgrade are exposing themselves to significant risks, from data loss to a complete network breach. In a world where attacks are becoming increasingly complex and automated, timely security updates and verification are no longer optional, but imperative to protect business infrastructure.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
