Cisco Patches Critical Flaws in IMC and SSM On-Prem

Cisco released security updates on Wednesday to address multiple critical vulnerabilities in its Integrated Management Controller and Smart Software Manager On-Prem, urging customers to apply patches immediately to prevent potential unauthorized access and system compromise.

The most severe issue, tracked as CVE-2026-20093 with a CVSS score of 9.8, affects the web-based management interface of the Cisco Integrated Management Controller, a baseboard management controller embedded in various Cisco servers. This flaw stems from improper handling of password change requests, enabling an unauthenticated remote attacker to send crafted HTTP requests and bypass authentication. A successful exploit could allow the attacker to alter user passwords, including those for administrator accounts, and gain full administrative access to the affected system.

The Integrated Management Controller provides out-of-band management capabilities, allowing administrators to monitor, control, and troubleshoot servers remotely via interfaces such as an HTML5 web console, SSH command line, XML API, and Redfish standard, even when the main operating system is powered off or unresponsive. Affected products...