Cisco published a cluster of advisories on October 7, including Smart Software Manager On-Prem access issues alongside NX-OS hardening notes. On the SSM advisory page, Cisco lists Security Impact Ratings that include Critical and Medium, with CVEs such as CVE-2026-20328 in the set. Always re-read the live advisory for your exact release — ratings and fixed versions move, and “close enough” version matching is how you mis-patch.
Who should flinch
If you run SSM On-Prem for license infrastructure, treat this like identity gear. It sits in a trusted place and quietly holds keys to your software entitlement kingdom. NX-OS folks should map the hardening guidance to each fabric and pair it with their normal upgrade train — not a heroic weekend after the scanner finally nags hard enough.
I am not turning this into a scare blog. I am saying: pull the advisory, match your versions, schedule the work. “We will get to it after the change freeze” is how Critical becomes an incident ticket with a longer title.
House practice
Subscribe to Cisco’s PSIRT feeds. Keep a spreadsheet of on-prem management planes. Patch the license servers with the same urgency you give the edge firewalls. Management planes are production, even when nobody streams video through them.
I am writing these as lab notes for people who actually patch boxes. If a link goes stale, chase the upstream project page. The habit matters more than any single advisory number in a blog post.
Schedule the maintenance window while the advisory is still boring. Waiting until it is exciting costs more.
Have a blessed day!