CVE-2026-20155
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) allows an authenticated attacker with low privileges to access sensitive information they are not authorized to see. This is due to improper authorization checks on a REST API endpoint.
Risk Assessment
An attacker can view session information of active users, including administrators, potentially leading to device compromise and network security breach.
Recommendation
Apply the Cisco-provided update for EPNM immediately and restrict management interface access to trusted IP addresses only.
Other vulnerabilities in Cisco Evolved Programmable Network Manager
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access. This vulnerability is due to improper authorization checks on a REST API endpoint of an affected device. An attacker could exploit this vulnerability by querying the affected endpoint. A successful exploit could allow the attacker to view session information of active Cisco EPNM users, including users with administrative privileges, which could result in the affected device being compromised.