Critical severity · published Oct 7, 2026
CVE-2026-76454
Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Cisco License On-Prem · Cisco
7-202001; 1.1; 6.3.0; 8-202004; 8-202006; 1.2; +30 more · source: vendor
Affected product
CL
Cisco License On-Prem
Cisco
More from Cisco License On-Prem
10.0
CVE-2026-76482
Cisco License On-Prem Security Hardening Release
9.8
CVE-2026-76480
Cisco License On-Prem Security Hardening Release
9.1
CVE-2026-76483
Cisco License On-Prem Security Hardening Release
9.1
CVE-2026-20328
Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
8.8
CVE-2026-76484
Cisco License On-Prem Security Hardening Release