CVE-2026-20155: Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access. This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20155?
CVE-2026-20155 is classified as a high-severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2026-20155?
To resolve CVE-2026-20155, update your Cisco Evolved Programmable Network Manager to the latest version provided by Cisco.
Who is affected by CVE-2026-20155?
Any organization using Cisco Evolved Programmable Network Manager with affected versions may be vulnerable to CVE-2026-20155.
What exploit scenarios are associated with CVE-2026-20155?
CVE-2026-20155 could allow authenticated, low-privileged users to gain unauthorized access to sensitive data.
Is there a workaround for CVE-2026-20155?
Currently, there are no documented workarounds for CVE-2026-20155, making upgrading the only mitigation method.