Cisco License On-Prem security hardening release fixes critical authentication, injection and credential flaws

What happened

Cisco's October 2026 security hardening release for Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) addresses four internally discovered vulnerabilities.

CVE-2026-76480 is an improper authentication flaw: an unauthenticated network attacker can gain access without credentials, with high impact on confidentiality, integrity and availability. CVE-2026-76482 is an improper input verification issue with a CVSS score of 10 and changed scope, allowing an unauthenticated network attacker to cause high impact across confidentiality, integrity and availability. CVE-2026-76483 leaves credentials insufficiently protected, allowing an unauthenticated network attacker to achieve high confidentiality and integrity impact. CVE-2026-76484 is a code injection flaw that an attacker with low privileges can exploit for high impact on confidentiality, integrity and availability.

Cisco PSIRT states that it is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.

Who is affected

The affected product is Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem. The listed affected versions are 7-202001, 1.1, 6.3.0, 8-202004, 8-202006, 1.2, 1.3 and 8-202012. No fixed version numbers are listed in the CVE records; obtain the applicable hardening release from Cisco's advisory.

What to do now

1. Review Cisco's advisory and apply the applicable security hardening release for your Cisco License On-Prem deployment.
2. Treat this as a patch priority. There are no workarounds that address these vulnerabilities.
3. Until the update is applied, restrict network access to the License On-Prem interface so that only trusted management networks can reach it.
4. Confirm which affected release you run against the affected versions listed above.

How to detect it

Cisco has not published indicators of compromise for these vulnerabilities. Because the flaws are reachable over the network before authentication, treat the License On-Prem interface as an exposed service: check that it is not accepting connections from untrusted networks and review authentication logs for unexpected or repeated access attempts.

Beyond the patch

These are the kind of flaws that an exposure inventory and a penetration test should catch before an advisory does. Our Virtual CISO Services (vCISO) will identify where License On-Prem is reachable and keep that exposure picture current; Implementation & Assessment Services finds authentication, injection and credential-protection issues in hardening and penetration tests; and Supply Chain Defense & Third-Party Risk tracks critical vendor patch cycles so a supplier's hardening release does not become your emergency.