Cisco License On-Prem up to 10-202606 Smart Licensing Utility API input validation

Summaryinfo

A vulnerability labeled as critical has been found in Cisco License On-Prem. This affects an unknown function of the component Smart Licensing Utility API. Such manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2026-76454. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Cisco License On-Prem. Affected by this issue is an unknown part of the component Smart Licensing Utility API. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity, and availability. CVE summarizes:

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

The advisory is available at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2026-76454 since 08/19/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/07/2026).

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Cisco

Name

• License On-Prem

Version

• 1.1
• 1.2
• 1.3
• 1.4
• 6.3.0
• 7-202001
• 8-202004
• 8-202006
• 8-202008
• 8-202010
• 8-202012
• 8-202102
• 8-202105
• 8-202108
• 8-202112
• 8-202201
• 8-202206
• 8-202212
• 8-202302
• 8-202303
• 8-202304
• 8-202308
• 8-202401
• 8-202404
• 9-202201
• 9-202406
• 9-202407
• 9-202410
• 9-202412
• 9-202501
• 9-202502
• 9-202504
• 9-202507
• 9-202510
• 9-202601
• 10-202606

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion