CVE-2026-20160 — Cisco Smart Software Manager On-Prem¶

Key facts

CVE-2026-20160 is a Critical (9.8) vulnerability: Cisco Smart Software Manager On-Prem. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-20160
Severity	Critical (9.8)
Product	Cisco Smart Software Manager On-Prem
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-20160/

Details¶

CVE-2026-20160 (Cisco Smart Software Manager On-Prem) is a Critical (9.8) vulnerability: Cisco Smart Software Manager On-Prem. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

Cisco Smart Software Manager On-Prem (SSM On-Prem) Remote Code Execution vulnerability. An unintentionally exposed internal service allows unauthenticated remote attackers to send crafted API requests and execute arbitrary commands with root-level privileges on the underlying operating system.

Vulnerability Details¶

Field	Value
CVE ID	CVE-2026-20160
Product	Cisco Smart Software Manager On-Prem
Affected Versions	9-202502 through 9-202510
CVSS Score	9.8 (Critical)
CWE	CWE-78 (OS Command Injection)
Type	Remote Code Execution
Authentication	Not Required
Attack Vector	Network
Privileges Required	None
User Interaction	None

Usage¶

python3 poc.py --target <url> [--check] [--verbose]

Arguments: - --target: Target SSM On-Prem URL (required) - --check: Only check if target is vulnerable (optional) - --verbose: Enable verbose output (optional)

Examples:

# Check if target is vulnerable
python3 poc.py --target https://ssm.example.com --check

# Execute exploit with verbose output
python3 poc.py --target https://ssm.example.com --verbose

# Basic exploitation
python3 poc.py --target https://ssm.example.com

Test Environment¶

docker-compose up -d

Prevention¶

See prevention/ directory for mitigation strategies and patches.

Disclaimer¶

This proof of concept is provided for educational and security research purposes only. The authors are not responsible for any misuse or damage caused by this code. Users are expected to comply with applicable laws and regulations and obtain proper authorization before testing on any systems they do not own or have explicit permission to test.

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-20160, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-20160 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Attempt - backend/internal"; flow:to_server,established; content:"POST"; http_method; content:"/backend/internal"; http_uri; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260001; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Attempt - api/v1/internal"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/internal"; http_uri; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260002; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Attempt - PUT backend/internal"; flow:to_server,established; content:"PUT"; http_method; content:"/backend/internal"; http_uri; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260003; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Attempt - PUT api/v1/internal"; flow:to_server,established; content:"PUT"; http_method; content:"/api/v1/internal"; http_uri; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260004; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Command Injection"; flow:to_server,established; content:"|22|"; http_client_body; pcre:"/[;&|`].*?(cat|echo|ls|id|whoami|uname|wget|curl|nc|netcat|bash|sh|cmd|powershell)/i"; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260005; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Shell Command"; flow:to_server,established; content:"Content-Type|3a 20|application/json"; http_header; pcre:"/(\$\(|`|%24%28).*?(wget|curl|nc|bash|sh|cmd)/i"; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260006; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Binary Execution"; flow:to_server,established; content:"/backend/internal"; http_uri; content:"exec"; http_client_body; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260007; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE System Function"; flow:to_server,established; content:"/api/v1/internal"; http_uri; content:"system"; http_client_body; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260008; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE eval() Function"; flow:to_server,established; pcre:"/\/(backend|api\/v1)\/internal/i"; content:"eval("; http_client_body; nocase; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260009; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE File Upload"; flow:to_server,established; content:"Content-Type|3a 20|multipart/form-data"; http_header; content:"/backend/internal"; http_uri; content:".php"; http_client_body; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260010; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Script Upload"; flow:to_server,established; content:"Content-Type|3a 20|multipart/form-data"; http_header; content:"/api/v1/internal"; http_uri; pcre:"/\.(php|jsp|asp|py|pl|sh)$/i"; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260011; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Path Traversal"; flow:to_server,established; content:"/backend/internal"; http_uri; content:"../"; http_client_body; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260012; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Environment Variable"; flow:to_server,established; content:"/api/v1/internal"; http_uri; pcre:"/\$[A-Z_]+/"; http_client_body; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260013; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Reverse Shell"; flow:to_server,established; pcre:"/\/(backend|api\/v1)\/internal/i"; content:"nc"; http_client_body; pcre:"/-[a-z]*e/i"; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260014; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET [443,8443] (msg:"CVE-2026-20160 Cisco Smart Software Manager On-Prem RCE Python Code"; flow:to_server,established; pcre:"/\/(backend|api\/v1)\/internal/i"; content:"import"; http_client_body; content:"os"; http_client_body; distance:0; within:20; metadata:cve CVE-2026-20160; classtype:attempted-admin; sid:20260015; rev:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_20160_Network_Traffic_Patterns
{
    meta:
        description = "Detects network traffic patterns for CVE-2026-20160 RCE exploitation"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $endpoint1 = "/backend/internal" nocase
        $endpoint2 = "/api/v1/internal" nocase
        $http_method1 = "POST " nocase
        $http_method2 = "PUT " nocase
        $content_type1 = "application/json" nocase
        $content_type2 = "application/x-www-form-urlencoded" nocase
        $user_agent1 = "python-requests" nocase
        $user_agent2 = "curl/" nocase
        $user_agent3 = "Wget/" nocase
        $exploit_param1 = "cmd=" nocase
        $exploit_param2 = "exec=" nocase
        $exploit_param3 = "command=" nocase

    condition:
        any of ($endpoint*) and any of ($http_method*) and 
        (any of ($content_type*) or any of ($user_agent*)) and
        any of ($exploit_param*)
}

rule CVE_2026_20160_Exploit_Payloads
{
    meta:
        description = "Detects exploit payloads for CVE-2026-20160 RCE"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $payload1 = "$(whoami)" nocase
        $payload2 = "`whoami`" nocase
        $payload3 = ";whoami;" nocase
        $payload4 = "&&whoami&&" nocase
        $payload5 = "||whoami||" nocase
        $payload6 = "/bin/bash" nocase
        $payload7 = "/bin/sh" nocase
        $payload8 = "powershell" nocase
        $payload9 = "cmd.exe" nocase
        $payload10 = "nc -e" nocase
        $payload11 = "netcat" nocase
        $payload12 = "bash -i" nocase
        $payload13 = "sh -i" nocase
        $payload14 = "/dev/tcp/" nocase
        $payload15 = "python -c" nocase
        $payload16 = "perl -e" nocase
        $payload17 = "ruby -e" nocase
        $payload18 = "wget http" nocase
        $payload19 = "curl http" nocase
        $payload20 = "chmod +x" nocase
        $payload21 = "rm -rf" nocase
        $payload22 = "cat /etc/passwd" nocase
        $payload23 = "cat /etc/shadow" nocase
        $payload24 = "uname -a" nocase
        $payload25 = "id;" nocase

    condition:
        any of them
}

rule CVE_2026_20160_Command_Injection_Patterns
{
    meta:
        description = "Detects command injection patterns for CVE-2026-20160"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $inject1 = /\$\([^)]+\)/ 
        $inject2 = /`[^`]+`/
        $inject3 = /;[^;]+;/
        $inject4 = /\|\|[^|]+\|\|/
        $inject5 = /&&[^&]+&&/
        $inject6 = /\|[^|]+\|/
        $inject7 = /exec\([^)]+\)/
        $inject8 = /system\([^)]+\)/
        $inject9 = /eval\([^)]+\)/
        $inject10 = /passthru\([^)]+\)/
        $inject11 = /shell_exec\([^)]+\)/
        $inject12 = /popen\([^)]+\)/

    condition:
        any of them
}

rule CVE_2026_20160_Log_Entry_Patterns
{
    meta:
        description = "Detects suspicious log entries for CVE-2026-20160 exploitation attempts"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $log_endpoint1 = "POST /backend/internal" nocase
        $log_endpoint2 = "PUT /backend/internal" nocase
        $log_endpoint3 = "POST /api/v1/internal" nocase
        $log_endpoint4 = "PUT /api/v1/internal" nocase
        $log_error1 = "500 Internal Server Error" nocase
        $log_error2 = "HTTP/1.1 500" nocase
        $log_error3 = "HTTP/1.0 500" nocase
        $log_shell1 = "/bin/bash" nocase
        $log_shell2 = "/bin/sh" nocase
        $log_shell3 = "cmd.exe" nocase
        $log_injection1 = "command injection" nocase
        $log_injection2 = "shell injection" nocase
        $log_injection3 = "code execution" nocase
        $log_exploit1 = "exploit" nocase
        $log_exploit2 = "payload" nocase
        $log_unauthorized1 = "unauthorized access" nocase
        $log_unauthorized2 = "privilege escalation" nocase

    condition:
        any of ($log_endpoint*) and (any of ($log_error*) or any of ($log_shell*) or 
        any of ($log_injection*) or any of ($log_exploit*) or any of ($log_unauthorized*))
}

rule CVE_2026_20160_Response_Patterns
{
    meta:
        description = "Detects suspicious response patterns indicating successful CVE-2026-20160 exploitation"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $response1 = "uid=" nocase
        $response2 = "gid=" nocase
        $response3 = "groups=" nocase
        $response4 = "root:" nocase
        $response5 = "/bin/bash" nocase
        $response6 = "/bin/sh" nocase
        $response7 = "Linux" nocase
        $response8 = "Darwin" nocase
        $response9 = "Windows" nocase
        $response10 = "Microsoft Windows" nocase
        $response11 = "total " nocase
        $response12 = "drwx" nocase
        $response13 = "-rwx" nocase
        $response14 = "listening on" nocase
        $response15 = "ESTABLISHED" nocase

    condition:
        any of them
}

rule CVE_2026_20160_Reverse_Shell_Patterns
{
    meta:
        description = "Detects reverse shell patterns for CVE-2026-20160"
        author = "Security Analyst"
        date = "2024"
        severity = "critical"
        cve = "CVE-2026-20160"
        product = "Cisco Smart Software Manager On-Prem"

    strings:
        $shell1 = /bash\s+-i\s+>\s*&\s*\/dev\/tcp\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,5}/
        $shell2 = /sh\s+-i\s+>\s*&\s*\/dev\/tcp\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,5}/
        $shell3 = /nc\s+-e\s+\/bin\/bash\s+[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\s+[0-9]{1,5}/
        $shell4 = /nc\s+-e\s+\/bin\/sh\s+[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\s+[0-9]{1,5}/
        $shell5 = /netcat\s+-e\s+\/bin\/bash\s+[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\s+[0-9]{1,5}/
        $shell6 = "python -c 'import socket" nocase
        $shell7 = "python3 -c 'import socket" nocase
        $shell8 = "perl -e 'use Socket" nocase
        $shell9 = "ruby -rsocket" nocase

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2026-20160 - Prevention Rules for Nginx
# Cisco Smart Software Manager On-Prem RCE Protection

# Rate limiting zone definition
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/m;
limit_req_zone $binary_remote_addr zone=backend_limit:10m rate=5r/m;

# Map for suspicious patterns
map $request_uri $is_rce_attempt {
    default 0;
    "~*\.\./\.\." 1;
    "~*etc/passwd" 1;
    "~*/proc/" 1;
    "~*cmd=" 1;
    "~*exec\(" 1;
    "~*system\(" 1;
    "~*shell_exec" 1;
    "~*eval\(" 1;
    "~*base64_decode" 1;
    "~*\${" 1;
    "~*\$\(" 1;
    "~*`.*`" 1;
    "~*\|.*;" 1;
    "~*&&" 1;
    "~*\|\|" 1;
}

# Backend internal endpoint protection
location /backend/internal {
    # Rate limiting
    limit_req zone=backend_limit burst=5 nodelay;

    # Block external access - only allow internal networks
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;

    # Header validation
    if ($http_content_type ~* "multipart/form-data.*boundary.*=.*[;<>]") {
        return 403;
    }

    # Block suspicious content types
    if ($content_type ~* "(text/x-|application/x-php|text/x-php)") {
        return 403;
    }

    # Request size limits
    client_max_body_size 1M;
    client_body_timeout 10s;
    client_header_timeout 10s;

    # Block RCE attempts
    if ($is_rce_attempt = 1) {
        return 403;
    }

    # Method restrictions
    if ($request_method !~ ^(GET|POST|PUT|DELETE)$) {
        return 405;
    }

    # Block null bytes and control characters
    if ($request_uri ~* "(\%00|\%0a|\%0d|\%27|\%3c|\%3e|\%00)") {
        return 403;
    }

    # User-Agent validation
    if ($http_user_agent ~* "(sqlmap|nikto|nmap|masscan|nessus|openvas|w3af|metasploit)") {
        return 403;
    }

    # Block empty or suspicious User-Agent
    if ($http_user_agent = "") {
        return 403;
    }

    proxy_pass http://backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# API v1 internal endpoint protection
location /api/v1/internal {
    # Rate limiting
    limit_req zone=api_limit burst=3 nodelay;

    # Restrict to internal networks only
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;

    # Content-Type enforcement for POST/PUT
    if ($request_method ~ ^(POST|PUT)$) {
        set $content_type_valid 0;
        if ($content_type ~* "application/json") {
            set $content_type_valid 1;
        }
        if ($content_type ~* "application/x-www-form-urlencoded") {
            set $content_type_valid 1;
        }
        if ($content_type_valid = 0) {
            return 415;
        }
    }

    # Block file upload attempts
    if ($content_type ~* "multipart/form-data") {
        return 403;
    }

    # Request size limits
    client_max_body_size 512k;
    client_body_timeout 5s;
    client_header_timeout 5s;

    # Block RCE patterns
    if ($is_rce_attempt = 1) {
        return 403;
    }

    # Block potential injection in query parameters
    if ($query_string ~* "(\%3c|\%3e|\%22|\%27|<|>|\"|'|union|select|insert|update|delete|drop|create|alter|exec|execute|script|javascript|vbscript)") {
        return 403;
    }

    # Method validation
    if ($request_method !~ ^(GET|POST|PUT|PATCH|DELETE|OPTIONS)$) {
        return 405;
    }

    # Authorization header check for sensitive endpoints
    if ($http_authorization = "") {
        return 401;
    }

    # Block requests with suspicious headers
    if ($http_x_forwarded_host) {
        return 403;
    }

    if ($http_x_real_ip ~* "(127\.0\.0\.1|localhost|\:\:1)") {
        return 403;
    }

    # Additional security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy strict-origin-when-cross-origin;

    proxy_pass http://backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_hide_header X-Powered-By;
    proxy_hide_header Server;
}

# Additional security for all locations
location ~* \.(php|asp|aspx|jsp|cgi|pl)$ {
    return 403;
}

location ~* /(\.git|\.svn|\.hg|\.bzr) {
    return 403;
}

:material-file-download: prevention/nginx.conf

# CVE-2026-20160 - Prevention Rules for Apache httpd
# Remote Code Execution - Cisco Smart Software Manager On-Prem

# Enable ModSecurity Rule Engine
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
    "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"

# CVE-2026-20160 - Block access to vulnerable endpoints
SecRule REQUEST_URI "@beginsWith /backend/internal" \
    "id:'202601',\
    phase:1,\
    block,\
    msg:'CVE-2026-20160 - Blocked access to vulnerable backend internal endpoint',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-20160',\
    tag:'RCE',\
    tag:'cisco-ssm'"

SecRule REQUEST_URI "@beginsWith /api/v1/internal" \
    "id:'202602',\
    phase:1,\
    block,\
    msg:'CVE-2026-20160 - Blocked access to vulnerable API internal endpoint',\
    logdata:'URI: %{REQUEST_URI}, IP: %{REMOTE_ADDR}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-20160',\
    tag:'RCE',\
    tag:'cisco-ssm'"

# Block common RCE payloads in requests
SecRule REQUEST_BODY "@detectSQLi" \
    "id:'202603',\
    phase:2,\
    block,\
    msg:'CVE-2026-20160 - SQL injection attempt detected',\
    logdata:'Payload: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-20160',\
    tag:'sqli'"

SecRule REQUEST_BODY "@contains exec\(" \
    "id:'202604',\
    phase:2,\
    block,\
    msg:'CVE-2026-20160 - Command execution attempt detected',\
    logdata:'Payload: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-20160',\
    tag:'command-injection'"

SecRule REQUEST_BODY "@rx (?i)(system|shell_exec|passthru|eval|base64_decode|gzinflate)" \
    "id:'202605',\
    phase:2,\
    block,\
    msg:'CVE-2026-20160 - Dangerous function call detected',\
    logdata:'Function: %{MATCHED_VAR}',\
    severity:'CRITICAL',\
    tag:'CVE-2026-20160',\
    tag:'code-injection'"

# Block serialized object payloads
SecRule REQUEST_BODY "@contains O:" \
    "id:'202606',\
    phase:2,\
    block,\
    msg:'CVE-2026-20160 - Serialized object detected',\
    logdata:'Payload: %{MATCHED_VAR}',\
    severity:'HIGH',\
    tag:'CVE-2026-20160',\
    tag:'deserialization'"

# Block specific headers that might be exploited
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(sqlmap|nmap|nikto|burp|python-requests)" \
    "id:'202607',\
    phase:1,\
    block,\
    msg:'CVE-2026-20160 - Malicious user agent detected',\
    logdata:'User-Agent: %{MATCHED_VAR}',\
    severity:'HIGH',\
    tag:'CVE-2026-20160',\
    tag:'scanner'"

# Rate limiting for vulnerable endpoints
SecAction "id:'202608',phase:1,initcol:ip=%{REMOTE_ADDR},pass,nolog"
SecRule IP:REQUEST_COUNT "@gt 10" \
    "id:'202609',\
    phase:1,\
    block,\
    msg:'CVE-2026-20160 - Rate limit exceeded',\
    logdata:'Requests: %{MATCHED_VAR}, IP: %{REMOTE_ADDR}',\
    severity:'HIGH',\
    tag:'CVE-2026-20160',\
    tag:'rate-limit',\
    expirevar:ip.request_count=60"

SecAction "id:'202610',phase:5,setvar:ip.request_count=+1,pass,nolog"

# mod_rewrite rules for additional protection
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/backend/internal [NC]
RewriteRule .* - [F,L]

RewriteCond %{REQUEST_URI} ^/api/v1/internal [NC]
RewriteRule .* - [F,L]

RewriteCond %{QUERY_STRING} (?i)(exec|system|passthru|shell_exec) [NC]
RewriteRule .* - [F,L]

RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)$ [NC]
RewriteRule .* - [F,L]

# Additional security headers
Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always unset Server
Header always unset X-Powered-By

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-20160?¶

CVE-2026-20160 is a Critical (9.8) vulnerability: Cisco Smart Software Manager On-Prem. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-20160?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-20160?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.