Multiple Vulnerabilities in Cisco Products Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2026-029

DATE(S) ISSUED:

04/02/2026

OVERVIEW:

Multiple vulnerabilities have been discovered in Cisco products, the most severe of which could allow for arbitrary code execution.

Cisco Smart Software Manager On‑Prem is a centralized Cisco tool used by organizations to manage software licenses, entitlements, and compliance for Cisco products within their own network environment.
Cisco Integrated Management Controller (IMC) is embedded server management software that allows administrators to remotely monitor, configure, and control Cisco servers without needing an operating system installed.
Cisco Evolved Programmable Network Manager (EPNM) is a network management platform used to provision, monitor, and automate large‑scale Cisco network infrastructures.
Cisco Nexus Dashboard is a centralized management and operations platform that provides visibility, policy management, and analytics across Cisco Nexus data center networks.
Cisco Nexus Dashboard Insights is an analytics and assurance application that runs on Nexus Dashboard to detect configuration issues, performance problems, and network anomalies in data center environments.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution, which may lead to the complete compromise of the affected device.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

Cisco Smart Software Manager On Prem versions prior to 9-202601
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) for UCS C-Series M5 Rack Server
Cisco Integrated Management Controller (IMC) versions prior to 4.3(6.260017) and 6.0(1.250174) for UCS C-Series M6 Rack Server
Cisco Integrated Management Controller (IMC) versions prior to 3.2.17 for UCS E-Series M3
Cisco Integrated Management Controller (IMC) versions prior to 4.15.3 for UCS E-Series M6
Cisco Integrated Management Controller (IMC) versions prior to 6.0(1.250192) (M6) for Cisco Telemetry Broker Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(6.260017) (M6) for IEC6400 Edge Compute Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) (M5) and 4.3(6.260017) (M6) for Secure Endpoint Private Cloud Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) (M5) and 4.3(6.260017) (M6) for Secure Endpoint Private Cloud Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) (M5) and 4.3(6.260017) (M6) for Secure Endpoint Private Cloud Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) (M5) and 6.0(1.250192) (M6) for Secure Network Analytics Appliances
Cisco Integrated Management Controller (IMC) versions prior to 4.3(2.260007) (M5), 4.3(6.260017) (M6), and 6.0(1.250174) (M6) for Secure Network Server Appliances
Cisco NFVIS versions prior to 4.15.5 for Cisco 500 Series ENCS
Cisco NFVIS versions prior to 4.18.3 (Apr 2026) for Cisco Catalyst 8300 Series Edge uCPE
Cisco Evolved Programmable Network Manager (EPNM) versions prior to 8.1.2
Cisco Nexus Dashboard 3.1, 3.2, 4.1, 4.2
Cisco Nexus Dashboard Insights 6.5 and earlier
Cisco Nexus Dashboard Fabric Controller versions prior to 12.2.2

RISK:

Government:

Large and medium government entitiesHIGH

Small governmentMEDIUM

Businesses:

Large and medium business entitiesHIGH

Small business entitiesMEDIUM

Home Users:

LOW

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Cisco products, the most severe of which could allow for arbitrary code execution. Details of the vulnerabilities are as follows:

Tactic: Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

A vulnerability was found in Cisco Smart Software Manager On‑Prem, associated with CVE‑2026‑20160 and CVE‑2026‑20151.
A vulnerability was found in Cisco Nexus Dashboard Fabric Controller, associated with CVE‑2024‑20432.
A vulnerability was found in Cisco Integrated Management Controller (IMC), associated with CVE‑2026‑20093, CVE‑2026‑20094, CVE‑2026‑20095, CVE‑2026‑20085, and CVE‑2026‑20087.
A vulnerability was found in Cisco Evolved Programmable Network Manager (EPNM), associated with CVE‑2026‑20155.
A vulnerability was found in Cisco Nexus Dashboard Insights, associated with CVE‑2026‑20174 and CVE‑2026‑20041.
A vulnerability was found in Cisco Nexus Dashboard, associated with CVE‑2026‑20041 and CVE‑2026‑20042.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution, which may lead to the complete compromise of the affected device.

RECOMMENDATIONS:

We recommend the following actions be taken:

Apply appropriate updates provided by Cisco to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.
Safeguard 12.1: Ensure Network Infrastructure is Up-to-Date: Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of software and/or using currently supported network-as-a-service (NaaS) offerings. Review software versions monthly, or more frequently, to verify software support.
Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.
Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.
Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)
Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. (M1016: Vulnerability Scanning)
Safeguard 16.13: Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft Data Execution Prevention (DEP), Windows Defender Exploit Guard (WDEG), or Apple System Integrity Protection (SIP) and Gatekeeper.
Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems. (M1030: Network Segmentation)
Safeguard 12.2: Establish and Maintain a Secure Network Architecture: Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum.