Cisco License On-Prem vulnerabilities allow unauthenticated access and file writes (CVE-2026-20328, CVE-2026-76454)

What happened

Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has four vulnerabilities in its web-based management interface and Smart Licensing Utility API. The two most severe, CVE-2026-20328 and CVE-2026-76454, are reachable over the network with no authentication and no user interaction. CVE-2026-20328 allows an attacker to reset the password of any account, including administrative accounts, and then access the application as that user. CVE-2026-76454 allows an attacker to send crafted requests to the Smart Licensing Utility API to write arbitrary files to the system or cause a denial of service.

Two further flaws require a valid administrator account. CVE-2026-76437 allows an authenticated administrator to execute commands on the underlying operating system with root privileges; Cisco notes that the only additional privilege gained is the ability to turn off the system. CVE-2026-76452 allows an authenticated administrator to read additional contents of the internal database through SQL injection.

Cisco PSIRT states it is not aware of any public announcements or malicious use of these vulnerabilities.

Who is affected

Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), is affected in the following versions: 7-202001, 1.1, 6.3.0, 8-202004, 8-202006, 1.2, 1.3, 8-202012. The product is Cisco's on-premises licence management application.

What to do now

1. Apply Cisco's software fixes. Cisco has released fixes for these vulnerabilities, but fixed version numbers are not listed here; refer to Cisco's advisory and match your deployment to the applicable release.
2. There are no workarounds. Cisco states that no workarounds address these vulnerabilities.
3. If you cannot patch immediately, restrict network access to the web-based management interface and Smart Licensing Utility API so they are reachable only from trusted management networks, and monitor for unexpected password resets, administrative configuration changes, and signs of denial of service.

How to detect it

Monitor the web-based management interface for unexpected password reset events or administrative account changes. For the API flaw, watch for signs of denial of service and review system files for unexpected changes. Treat unusual administrative configuration changes or unexplained system-shutdown commands as suspicious.

Beyond the patch

These vulnerabilities show how an unauthenticated path into a licensing system can hand an attacker control of a critical support function. Because the two critical flaws need no credentials, confirm that Cisco License On-Prem is not reachable from untrusted networks; our Virtual CISO Services (vCISO) help build that exposure and monitoring picture. And because the window between a vendor fix and your upgrade depends on how well you track supplier software, our Supply Chain Defense & Third-Party Risk engagement helps you know which Cisco products you run and how quickly you need to move.