# CVE-2026-20160

> Critical unauthenticated remote code execution vulnerability (CVSS 9.8) in Cisco Smart Software Manager On-Prem (SSM On-Prem) caused by unintentional exposure of an internal service (CWE-668: Exposure of Resource to Wrong Sphere). An unauthenticated remote attacker can send a crafted request to the API of the exposed service to execute arbitrary commands on the underlying operating system with root-level privileges. The attack is network-based with low complexity, requiring no privileges or user interaction. Disclosed by Cisco PSIRT on April 1, 2026 alongside CVE-2026-20093 as part of a critic

- **CVSS:** 9.8 (CRITICAL)
- **EPSS:** 0.2%
- **CWE:** CWE-668

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-20160
Full threat coverage + IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp