Is CVE-2026-20123 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20123 being exploited in the wild.

How severe is CVE-2026-20123?

Medium severity, with a CVSS score of 4.3, published 4 February 2026.

Which products and versions are affected?

Cisco Evolved Programmable Network Manager Versions prior to 8.1.1; Cisco Prime Infrastructure Versions prior to 3.10.6 Security Update 2.

Is there a fix for CVE-2026-20123?

A patch was published on 2026-02-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20123 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20123?

Check whether you run Cisco Evolved Programmable Network Manager or Cisco Prime Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20123: Cisco EPNM and Prime Infrastructure open redirect in web interface

CVE-2026-20123 · Severity: medium · CVSS 4.3 · Published 2026-02-04

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure, which are used to manage and monitor large-scale network environments, contain a security flaw in their web management interface. An attacker could trick a legitimate user into clicking a modified link that redirects them to a malicious website. This could be used in phishing campaigns to steal user credentials or deliver malware by making the malicious site appear to be part of the trusted Cisco management console.

Technologies: Cisco Evolved Programmable Network Manager, Cisco Prime Infrastructure. Vendors: Cisco.

Quick answers

Is CVE-2026-20123 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20123 being exploited in the wild.
How severe is CVE-2026-20123?: Medium severity, with a CVSS score of 4.3, published 4 February 2026.
Which products and versions are affected?: Cisco Evolved Programmable Network Manager Versions prior to 8.1.1; Cisco Prime Infrastructure Versions prior to 3.10.6 Security Update 2.
Is there a fix for CVE-2026-20123?: A patch was published on 2026-02-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20123 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20123?: Check whether you run Cisco Evolved Programmable Network Manager or Cisco Prime Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in the web-based management interface of Cisco EPNM and Cisco Prime Infrastructure due to improper input validation of HTTP request parameters. A remote, unauthenticated attacker can exploit this by convincing a user to follow a specially crafted link or by intercepting and modifying a user's HTTP request. Successful exploitation allows the attacker to redirect the victim to an arbitrary external URL. This vulnerability is addressed in Cisco EPNM version 8.1.1 and Cisco Prime Infrastructure 3.10.6 Security Update 2. No workarounds are available.

Affected products

Cisco Evolved Programmable Network Manager (EPNM) Versions prior to 8.1.1
Cisco Prime Infrastructure Versions prior to 3.10.6 Security Update 2

Timeline

2026-02-04: advisory: Initial public release by Cisco
2026-02-04: disclosed
2026-02-04: patched

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-pi-redirect-6sX82dN

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.