{"id":230497,"date":"2026-04-02T11:21:00","date_gmt":"2026-04-02T15:21:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/02\/cisco-patches-9-8-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise\/"},"modified":"2026-04-02T15:20:25","modified_gmt":"2026-04-02T19:20:25","slug":"cisco-patches-9-8-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/02\/cisco-patches-9-8-cvss-imc-and-ssm-flaws-allowing-remote-system-compromise\/","title":{"rendered":"Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/cisco-patches-98-cvss-imc-and-ssm-flaws.html\">Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise<\/a><\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/cisco-patches-98-cvss-imc-and-ssm-flaws.html\">https:\/\/thehackernews.com\/2026\/04\/cisco-patches-98-cvss-imc-and-ssm-flaws.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-04-02 11:21:00<\/a><\/p>\n<p>Source Domain: <a href=\"thehackernews.com\">thehackernews.com<\/a><\/p>\n<p><span class=\"p-author\">\ue804<span class=\"author\">Ravie Lakshmanan<\/span>\ue802<span class=\"author\">Apr 02, 2026<\/span><\/span><span class=\"p-tags\">Network Security \/ Vulnerability<\/span><\/p>\n<p>Cisco\u00a0has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system with elevated privileges.<\/p>\n<p>The\u00a0vulnerability, tracked as CVE-2026-20093, carries a CVSS score of 9.8\u00a0out of a maximum of\u00a010.0.<\/p>\n<p>&#8220;This vulnerability is due to incorrect handling of password change requests,&#8221;\u00a0Cisco said in an advisory released Wednesday. &#8220;An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected\u00a0device.&#8221;<\/p>\n<p>&#8220;A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that\u00a0user.&#8221;<\/p>\n<p>Security researcher &#8220;jyh&#8221; has been credited with discovering and reporting the vulnerability. The\u00a0shortcoming affects the following products regardless of the device configuration\u00a0&#8211;\u00a0<\/p>\n<ul>\n<li>5000 Series Enterprise Network Compute Systems (ENCS) &#8211; Fixed in 4.15.5<\/li>\n<li>Catalyst 8300 Series Edge uCPE &#8211; Fixed in 4.18.3<\/li>\n<li>UCS C-Series M5 and M6 Rack Servers in standalone mode &#8211; Fixed in 4.3(2.260007), 4.3(6.260017), and 6.0(1.250174)<\/li>\n<li>UCS E-Series Servers M3 &#8211; Fixed in 3.2.17<\/li>\n<li>UCS E-Series Servers M6 &#8211; Fixed in 4.15.3<\/li>\n<\/ul>\n<p>Another critical vulnerability patched by Cisco impacts Smart Software Manager On-Prem (SSM On-Prem), which could enable an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. The\u00a0vulnerability, CVE-2026-20160 (CVSS score: 9.8), stems from an unintentional exposure of an internal\u00a0service.<\/p>\n<p>&#8220;An attacker could exploit this vulnerability by sending a crafted request to the API of the exposed service,&#8221;\u00a0Cisco said. &#8220;A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.&#8221;<\/p>\n<p>Patches for the flaw\u00a0have&#8230;<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/04\/cisco-patches-98-cvss-imc-and-ssm-flaws.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise https:\/\/thehackernews.com\/2026\/04\/cisco-patches-98-cvss-imc-and-ssm-flaws.html Publish Date:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":230498,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjH6wuST9R8voZTpCC-v5LSwd4O7vlbuRDhXMzcSw9iu0k2JvFOao-3Jr2o9iCs0jqX3pIqHvcYo_n-5Ad80WXeQXKV_DTgJUN0A6nl9f73BA1U0wRoZBqgySfDR6Uk7KD8jXzw2BFLGvusf-96qsINw9jT4PnglZohYM2VhSsdHcpw-cl6vwAekfE-KD_H\/s1600\/cisco-exploit.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[31,29,27],"class_list":["post-230497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-exploit","tag-network-security","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230497"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=230497"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230497\/revisions"}],"predecessor-version":[{"id":230499,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/230497\/revisions\/230499"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/230498"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=230497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=230497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=230497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}