Changeflow GovPing Data Privacy & Cybersecurity Multiple Cisco Vulnerabilities Allowing Remote ...
Priority review Notice Added Final

Multiple Cisco Vulnerabilities Allowing Remote Code Execution

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued advisory CERTFR-2026-AVI-0388 alerting to five critical vulnerabilities in multiple Cisco product families affecting the Cisco Integrated Management Controller (IMC), NFVIS, Evolved Programmable Network Manager (EPNM), and Smart Software Manager On-Prem. The vulnerabilities could allow unauthenticated remote code execution, privilege escalation, authentication bypass, and improper authentication, posing severe risks to data confidentiality and system integrity.

View original document View source feed page

What changed

CERT-FR reported five distinct vulnerabilities in Cisco products sourced from Cisco security bulletins dated 01 April 2026. Affected products include Cisco IMC versions prior to specified patches (6.0(1.250174) for M6 Rack Servers, 3.2.17 for E-Series M3, 4.15.3 for E-Series M6), Cisco NFVIS prior to 4.15.5 and 4.18.3, EPNM prior to version 8.1.2, and SSM On-Prem prior to 9-202601. The vulnerabilities enable authentication bypass, command injection, privilege escalation, and improper authentication that could lead to arbitrary remote code execution and data confidentiality breaches.

System administrators must immediately consult Cisco's security advisory pages at sec.cloudapps.cisco.com for patched versions and apply available updates. Organizations should conduct vulnerability scanning across their Cisco infrastructure to identify all affected deployments. Given the severity of remote code execution risks, priority patching is critical for any exposed systems, particularly those handling sensitive data or operating in government environments.

What to do next

  1. Apply Cisco patches for affected IMC versions (6.0(1.250174), 3.2.17, 4.15.3, 4.3(2.260007), 4.3(6.260017), 6.0(1.250192))
  2. Upgrade Cisco NFVIS to versions 4.15.5 (5000 Series ENCS) or 4.18.3 (Catalyst 8300 Series)
  3. Update EPNM to version 8.1.2 and SSM On-Prem to version 9-202601
  4. Scan infrastructure for affected Cisco product deployments and prioritize remediation

Archived snapshot

Apr 2, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 02 avril 2026 N° CERTFR-2026-AVI-0388 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Cisco

Gestion du document

| Référence | CERTFR-2026-AVI-0388 |
| Titre | Multiples vulnérabilités dans les produits Cisco |
| Date de la première version | 02 avril 2026 |
| Date de la dernière version | 02 avril 2026 |
| Source(s) | Bulletin de sécurité Cisco cisco-sa-cimc-auth-bypass-AgG2BxTn du 01 avril 2026
Bulletin de sécurité Cisco cisco-sa-cimc-cmd-inj-3hKN3bVt du 01 avril 2026
Bulletin de sécurité Cisco cisco-sa-cssm-priv-esc-xRAnOuO8 du 01 avril 2026
Bulletin de sécurité Cisco cisco-sa-epnm-improp-auth-mUwFWUU3 du 01 avril 2026
Bulletin de sécurité Cisco cisco-sa-ssm-cli-execution-cHUcWuNr du 01 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Exécution de code arbitraire à distance
  • Élévation de privilèges

Systèmes affectés

  • Cisco IMC versions 6.x antérieures à 6.0(1.250174) sur UCS C-Series M6 Rack Server
  • Cisco IMC versions antérieures à 3.2.17 sur UCS E-Series M3
  • Cisco IMC versions antérieures à 4.15.3 sur UCS E-Series M6
  • Cisco IMC versions antérieures à 4.3(2.260007) (M5) et 4.3(6.260017) (M6) sur Secure Endpoint Private Cloud Appliances
  • Cisco IMC versions antérieures à 4.3(2.260007) (M5) et 4.3(6.260017) (M6) sur Secure Firewall Management Center Appliances
  • Cisco IMC versions antérieures à 4.3(2.260007) (M5) et 4.3(6.260017) (M6) sur Secure Malware Analytics Appliances
  • Cisco IMC versions antérieures à 4.3(2.260007) (M5) et 6.0(1.250192) (M6) sur Secure Network Analytics Appliances
  • Cisco IMC versions antérieures à 4.3(2.260007) (M5), 4.3(6.260017) (M6) et 6.0(1.250174) (M6) sur Secure Network Server Appliances
  • Cisco IMC versions antérieures à 4.3(2.260007) sur UCS C-Series M5 Rack Server
  • Cisco IMC versions antérieures à 4.3(6.260017) (M6) sur IEC6400 Edge Compute Appliances
  • Cisco IMC versions antérieures à 4.3(6.260017) sur UCS C-Series M6 Rack Server
  • Cisco IMC versions antérieures à 6.0(1.250192) (M6) sur Cisco Telemetry Broker Appliances
  • Cisco NFVIS versions antérieures à 4.15.5 sur Cisco 5000 Series ENCS
  • Cisco NFVIS versions antérieures à 4.18.3 sur Cisco Catalyst 8300 Series Edge uCPE
  • Evolved Programmable Network Manager (EPNM) versions antérieures à 8.1.2
  • Smart Software Manager On-Prem (SSM On-Prem) versions antérieures à 9-202601

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 02 avril 2026 Version initiale

Named provisions

Avis du CERT-FR Risques Systèmes affectés Résumé Solutions Documentation

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach
Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in SAP Products Allow Remote Code Execution
Priority review Apr 14, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Siemens Products Allow Remote Code Execution
Priority review Apr 14, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 2nd, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
CERTFR-2026-AVI-0388

Who this affects

Applies to
Technology companies Government agencies Telecommunications firms
Industry sector
3341 Computer & Electronics Manufacturing 5170 Telecommunications 9211 Government & Public Administration
Activity scope
Vulnerability Management Network Infrastructure Security Remote Code Execution Prevention
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Defense & National Security

Browse Categories

Agriculture & Food Safety 65 AI Regulation 3 Banking & Finance 319 Consumer Protection 48 Courts & Legal 361 Data Privacy & Cybersecurity 77 Defense & National Security 51 Education 24 Energy 100 Environment 86 Environmental & Energy 17 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 278 Government Operations 96 Healthcare 136 Healthcare & Life Sciences 10 Housing 16 Immigration 8 Immigration & Border Control 2 Insurance 58 Labor & Employment 115 Legal & Judicial 16 Pharma & Drug Safety 101 Pharma & Healthcare 1 Public Health 2 Real Estate & Housing 32 Sanctions & Export Controls 1 Securities & Investments 15 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 8 Telecom & Technology 47 Trade & Commerce 3 Trade & Sanctions 135 Transportation 63

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!