CVE-2026-20151

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User. Note: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

Configurations

No configuration.

History

01 Apr 2026, 17:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-01 17:28

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20151

Mitre link : CVE-2026-20151

CVE.ORG link : CVE-2026-20151

JSON object : View

Products Affected

No product.

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-20151", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20151", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Smart Software Manager On-Prem", "versions": [{"status": "affected", "version": "7-202001"}, {"status": "affected", "version": "8-202004"}, {"status": "affected", "version": "8-202006"}, {"status": "affected", "version": "8-202012"}, {"status": "affected", "version": "8-202010"}, {"status": "affected", "version": "8-202008"}, {"status": "affected", "version": "9-202201"}, {"status": "affected", "version": "8-202102"}, {"status": "affected", "version": "8-202105"}, {"status": "affected", "version": "8-202108"}, {"status": "affected", "version": "8-202112"}, {"status": "affected", "version": "8-202201"}, {"status": "affected", "version": "8-202206"}, {"status": "affected", "version": "8-202212"}, {"status": "affected", "version": "8-202302"}, {"status": "affected", "version": "8-202303"}, {"status": "affected", "version": "8-202304"}, {"status": "affected", "version": "8-202308"}, {"status": "affected", "version": "8-202401"}, {"status": "affected", "version": "8-202404"}, {"status": "affected", "version": "9-202406"}, {"status": "affected", "version": "9-202407"}, {"status": "affected", "version": "9-202410"}, {"status": "affected", "version": "9-202412"}, {"status": "affected", "version": "9-202501"}, {"status": "affected", "version": "9-202502"}, {"status": "affected", "version": "9-202504"}, {"status": "affected", "version": "9-202507"}, {"status": "affected", "version": "9-202510"}], "defaultStatus": "unknown"}]}], "published": "2026-04-01T17:28:31.097", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system.\r\n\r\nThis vulnerability is due to the improper transmission of sensitive user information. An attacker could exploit this vulnerability by sending a crafted message to an affected Cisco SSM On-Prem host and retrieving session credentials from subsequent status messages. A successful exploit could allow the attacker to elevate privileges on the affected system from low to administrative.\r\nTo exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of System User.\r\nNote: This vulnerability exposes information only about users who logged in to the Cisco SSM On-Prem host using the web interface and who are currently logged in. SSH sessions are not affected."}], "lastModified": "2026-06-17T10:17:13.233", "sourceIdentifier": "psirt@cisco.com"}