High

Cisco has issued a critical security warning about a severe vulnerability affecting its Smart Software Manager On-Prem (SSM On-Prem) platform, a tool widely used by enterprises to manage software licenses locally. Tracked as CVE-2026-20160, the flaw carries a near-maximum CVSS score of high, indicating extremely high risk. The vulnerability allows an unauthenticated remote attacker to gain full control of the affected system without requiring any credentials or prior access, making it particularly dangerous for enterprise environments.

The root cause of this issue lies in an internal system service that was unintentionally exposed. Attackers can exploit this weakness by sending specially crafted requests to the application’s API, which triggers the vulnerability. If successful, the attacker can execute arbitrary commands on the underlying operating system with root-level privileges. This level of access effectively gives complete administrative control, enabling threat actors to steal sensitive data, deploy ransomware, or move laterally across the network to compromise additional systems.

The vulnerability specifically affects certain versions of SSM On-Prem released within the past year. Versions ranging from 9-202502 to 9-202510 are confirmed to be vulnerable, while versions prior to 9-202502 are not affected. Cisco has addressed the issue in version 9-202601, which includes the official security patch. Importantly, Cisco clarified that this vulnerability does not impact other related products, such as the Smart Licensing Utility or Smart Software Manager satellite deployments, limiting the scope to on-premise instances only.

Currently, there are no available workarounds or temporary mitigations, making immediate patching the only effective defense. Although no active exploitation has been observed so far, the public disclosure of the vulnerability significantly increases the risk of imminent attacks, as threat actors may attempt to reverse-engineer the fix and scan for exposed systems. The flaw was initially discovered internally by Cisco’s Technical Assistance Center during a support case, but organizations are strongly advised to prioritize upgrading to the patched version to prevent potential compromise and safeguard their networks.