According to its self-reported version, Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) is affected by multiple vulnerabilities, including:

  - A vulnerability in the web-based management interface of Cisco License On-Prem could allow an     unauthenticated, remote attacker to gain unauthorized access to an affected application. This     vulnerability is due to improper checks during the password reset process. A successful exploit could     allow the attacker to reset the password of an arbitrary account, including high-privileged     administrative user accounts. (CVE-2026-20328)

  - A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem could allow an     unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an     affected application. This vulnerability is due to improper input validation and a lack of authentication     in the management API. (CVE-2026-76454)

  - A vulnerability in the web-based user interface of Cisco License On-Prem could allow an authenticated,     remote attacker with valid administrative credentials to execute arbitrary commands on the underlying     operating system with root privileges. This vulnerability is due to improper validation of user-supplied     content within configurations that are submitted to the web-based management interface. (CVE-2026-76437)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)

critical Nessus Plugin ID 364455

Version 1.2