Cisco's Critical Week: IMC Auth Bypass and SSM RCE — Both at CVSS 9.8
Two CVSS 9.8 vulnerabilities hit Cisco management infrastructure. IMC auth bypass lets attackers take over any admin account. SSM On-Prem gives unauthenticated root access. Neither requires credentials.
Cisco dropped two critical patches this week, both scoring CVSS 9.8. One lets unauthenticated attackers bypass authentication and take over any admin account on Cisco servers. The other gives remote root access to Cisco's license management platform. Neither requires credentials.
This comes just weeks after Cisco's Secure Firewall Management Center (FMC) was hit by zero-day exploitation from the Interlock ransomware gang — and days after Cisco's own development environment was breached via the Trivy supply chain attack.
Cisco is having a rough quarter. Here's what you need to know.
CVE-2026-20093: IMC Authentication Bypass (CVSS 9.8)
What It Is
Cisco Integrated Management Controller (IMC) is the out-of-band management module embedded on the motherboard of Cisco UCS C-Series and E-Series servers. It provides remote management via web interface, CLI, and XML API — even when the server's operating system is powered off or crashed. It's the management backdoor that IT teams rely on to control their physical infrastructure.
CVE-2026-20093 is an authentication bypass in IMC's password change functionality. An unauthenticated remote attacker can send a crafted HTTP request to bypass authentication entirely, change the password of any user on the system — including the Admin account — and gain full access.
Why It Matters
IMC controls the physical server. Admin access to IMC means:
- Full hardware control — power on/off, BIOS configuration, firmware updates
- Console access — virtual KVM to the server as if you were physically present
- Storage manipulation — mount virtual media, modify boot order
- Network reconfiguration — change management network settings
- Credential theft — access stored credentials for other management interfaces
This isn't just a software vulnerability. It's a path to owning the physical infrastructure.
Affected Products
| Product | Fixed Version |
|---|---|
| 5000 Series Enterprise Network Compute Systems (ENCS) | 4.15.5 |
| Catalyst 8300 Series Edge uCPE | 4.18.3 |
| UCS C-Series M5 and M6 Rack Servers (standalone) | 4.3(2.260007), 4.3(6.260017), 6.0(1.250174) |
| UCS E-Series Servers M3 | 3.2.17 |
| UCS E-Series Servers M6 | 4.15.3 |
No workarounds exist. Cisco "strongly recommends" patching immediately.
CVE-2026-20160: SSM On-Prem Remote Code Execution (CVSS 9.8)
What It Is
Cisco Smart Software Manager On-Prem (SSM On-Prem) is the on-premises license management platform for organizations that can't use Cisco's cloud-based licensing. It handles software entitlements, license allocation, and compliance tracking for Cisco products across the network.
CVE-2026-20160 exposes an internal service API that should never be reachable from the network. An unauthenticated attacker can send a crafted request to this API and execute arbitrary commands on the underlying operating system with root-level privileges.
Why It Matters
SSM On-Prem is a license management server — it knows every Cisco product in your environment, their versions, and their license status. Root access means:
- Complete network inventory exposure — attackers learn exactly what Cisco equipment you run
- License manipulation — disable or modify software entitlements
- Pivot point — SSM communicates with every managed Cisco device on the network
- Persistence — root on a management server that IT rarely monitors for compromise
The vulnerability was discovered internally by Cisco during a TAC support case — meaning it was found by accident while troubleshooting something else.
Fix
Update to SSM On-Prem version 9-202601.
The Pattern: Cisco Management Tools Under Fire
These two vulnerabilities don't exist in isolation. Look at Cisco's last 60 days:
CVE-2026-20131 — Secure Firewall Management Center (FMC)
Maximum severity RCE, exploited as a zero-day by the Interlock ransomware gang since January 2026. Added to CISA KEV with a 3-day remediation deadline. The attack gave root access to the platform that manages every Cisco firewall in the organization.
CVE-2026-20079 — Firewall Management Center
Another critical FMC vulnerability, CVSS 10.0, patched earlier in March.
Trivy Supply Chain Breach
Cisco's internal development environment was breached using credentials stolen during the Trivy vulnerability scanner supply chain attack. Source code was stolen.
CVE-2026-20093 — IMC Authentication Bypass
CVSS 9.8. Unauthenticated admin takeover on physical server management.
CVE-2026-20160 — SSM On-Prem RCE
CVSS 9.8. Unauthenticated root access on license management.
The pattern is unmistakable: every critical Cisco vulnerability in 2026 targets management infrastructure. Not the firewalls themselves. Not the switches. Not the routers. The tools that manage them.
Compromise the management plane and you inherit control over everything it manages. Attackers know this. That's why FMC, IMC, and SSM are being targeted — they're the keys to the kingdom.
What You Should Do
Immediate Actions
- Patch CVE-2026-20093 (IMC) — No workaround exists. Every affected server is vulnerable until updated.
- Patch CVE-2026-20160 (SSM On-Prem) — Update to 9-202601.
- Verify IMC is not internet-exposed. IMC should only be accessible on a dedicated management network. If it's reachable from the internet, assume it's been probed.
- Audit SSM On-Prem access logs for unusual API requests to internal services.
Strategic Recommendations
- Segment management interfaces. IMC, FMC, SSM — none of these should be on the same network as production traffic.
- Monitor management plane traffic. Unusual HTTP requests to IMC or API calls to SSM should trigger alerts.
- Track Cisco advisories actively. Four critical management infrastructure vulnerabilities in 60 days is not a coincidence — it's a trend.
The Bigger Picture
Cisco equipment runs a significant portion of the world's enterprise networks. When their management tools are compromised, the blast radius extends to every device those tools control.
2026 is proving that network management infrastructure — the platforms security teams use to manage their defenses — is the most valuable target class for attackers. We've seen it with Cisco FMC, F5 BIG-IP, Fortinet FortiClient EMS, and now Cisco IMC and SSM.
The tools that are supposed to protect your network are the way in. Track them accordingly.
Track Cisco vulnerabilities on VulnTracker. Get notified when new CVEs are published, when exploit status changes, and when CISA adds them to KEV — before the next advisory drops.