---
id: 8820
title: "Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE"
source_domain: starlabs.sg
source_url: "https://starlabs.sg/blog/2026/09-dirty-cert-cisco-smart-software-managers-silently-patched-rce/"
published_at: "2026-09-24T00:00:00Z"
tags: ["rce", "zero-day", "vulnerability-research", "tls", "cisco", "certificate", "command-injection", "vulnerability-analysis", "nginx", "post-auth"]
phying_url: "https://phying.com/item/8820"
lang: en
---

# Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE

## Summary

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

## Intelligence Metadata

- **Sources:** starlabs.sg
- **Published:** 2026-09-24T00:00:00Z
- **Original:** https://starlabs.sg/blog/2026/09-dirty-cert-cisco-smart-software-managers-silently-patched-rce/
- **Phying News:** https://phying.com/item/8820