Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Cisco License On-Prem allows remote file changes or shutdown

CVE-2026-76454 · published 4 days ago
Summary

Cisco License On-Prem's management interface can be accessed without any login, letting an outsider send specially crafted requests. This can result in unauthorized files being written to the server or the application becoming unavailable. Apply the vendor's security update or restrict network access to the API immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco cisco license on-prem 7-202001
Original advisory text
Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.

This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-23Relative Path Traversal
Timeline
Published7 Oct 2026
Updated8 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-76454 · NVD
CVE-2026-76454 · MITRE
Track software like this
Free during beta