CVE-2026-20980

Medium · 6.8

CVSS

6.8

EPSS

0.3%

Published

Feb 4, 2026

CISA due date

—

The record

Improper input validation in PACM prior to SMR Feb-2026 Release 1 allows physical attacker to execute arbitrary commands.

Ecosystem	Package	Introduced	Fixed