Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

Summary: Cisco released patches for two critical vulnerabilities, CVE-2026-20093 in the Integrated Management Controller and CVE-2026-20160 in Smart Software Manager On-Prem, both rated 9.8 out of 10.0 CVSS. The IMC flaw stems from incorrect handling of password change requests and lets an unauthenticated remote attacker send a crafted HTTP request to bypass authentication and alter any user's password, including an Admin's, while the SSM On-Prem flaw is an unintentionally exposed internal service whose API allows crafted requests to run commands with root-level privileges.
Why it matters: Both flaws are unauthenticated and remote, and the IMC bug lets an attacker rewrite the Admin password and take the system as that user; Cisco says neither has been exploited in the wild, but recently disclosed Cisco flaws have been weaponized by threat actors, and there is no workaround.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20093 CVE-2026-20160
Related: ⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026