Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-76484 (GCVE-0-2026-76484)

Vulnerability from nvd – Published: 2026-10-07 16:17 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76484 are related to issues with insufficient protection against code injection that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-94.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:45.204Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76484 are related to issues with insufficient protection against code injection that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-94."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:17:08.504Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97294"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76484",
    "datePublished": "2026-10-07T16:17:08.504Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:45.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76483 (GCVE-0-2026-76483)

Vulnerability from nvd – Published: 2026-10-07 16:16 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76483 are related to issues with insufficiently protected credentials that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:44.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76483 are related to issues with insufficiently protected credentials that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:16:06.849Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97305"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76483",
    "datePublished": "2026-10-07T16:16:06.849Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:44.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76482 (GCVE-0-2026-76482)

Vulnerability from nvd – Published: 2026-10-07 16:16 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76482 are related to issues with improper input verification that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-347.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76482",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:43.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76482 are related to issues with improper input verification that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-347."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:16:00.719Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97297"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76482",
    "datePublished": "2026-10-07T16:16:00.719Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:43.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76480 (GCVE-0-2026-76480)

Vulnerability from nvd – Published: 2026-10-07 16:15 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76480 are related to issues with improper authentication that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-306.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:42.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76480 are related to issues with improper authentication that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-306."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:15:52.636Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97303"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76480",
    "datePublished": "2026-10-07T16:15:52.636Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:42.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76454 (GCVE-0-2026-76454)

Vulnerability from nvd – Published: 2026-10-07 16:12 – Updated: 2026-10-07 16:54

Title

Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

Summary

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 16:53 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:53:51.176135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T16:54:07.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.\r\n\r\nThis vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "Relative Path Traversal",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:31.265Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwu54774"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76454",
    "datePublished": "2026-10-07T16:12:31.265Z",
    "dateReserved": "2026-08-19T12:02:03.636Z",
    "dateUpdated": "2026-10-07T16:54:07.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76452 (GCVE-0-2026-76452)

Vulnerability from nvd – Published: 2026-10-07 16:12 – Updated: 2026-10-07 17:43

Title

Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

Summary

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality. To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 17:42 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T17:42:56.759473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T17:43:19.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality.\r\nTo exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:12.545Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53814"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem SQL Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76452",
    "datePublished": "2026-10-07T16:12:12.545Z",
    "dateReserved": "2026-08-19T12:02:03.636Z",
    "dateUpdated": "2026-10-07T17:43:19.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76437 (GCVE-0-2026-76437)

Vulnerability from nvd – Published: 2026-10-07 16:12 – Updated: 2026-10-07 18:05

Title

Cisco Smart Software Manager On-Prem Command Injection Vulnerability

Summary

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 17:58 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T17:58:37.739575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T18:05:43.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.\r\n\r\nThis vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges.\r\nTo exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:22.493Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53807"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76437",
    "datePublished": "2026-10-07T16:12:22.493Z",
    "dateReserved": "2026-08-19T12:02:03.635Z",
    "dateUpdated": "2026-10-07T18:05:43.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20328 (GCVE-0-2026-20328)

Vulnerability from nvd – Published: 2026-10-07 16:12 – Updated: 2026-10-08 13:04

Title

Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

Summary

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 03:55 UTC

CWE

CWE-862 - Missing Authorization

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T03:55:34.596041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:04:30.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.\r\n\r\nThis vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:04.453Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53803"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20328",
    "datePublished": "2026-10-07T16:12:04.453Z",
    "dateReserved": "2025-10-08T11:59:15.412Z",
    "dateUpdated": "2026-10-08T13:04:30.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76484 (GCVE-0-2026-76484)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:17 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76484 are related to issues with insufficient protection against code injection that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-94.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:45.204Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76484 are related to issues with insufficient protection against code injection that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-94."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:17:08.504Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97294"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76484",
    "datePublished": "2026-10-07T16:17:08.504Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:45.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76483 (GCVE-0-2026-76483)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:16 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76483 are related to issues with insufficiently protected credentials that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:44.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. \u0026nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76483 are related to issues with insufficiently protected credentials that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-522."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:16:06.849Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97305"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76483",
    "datePublished": "2026-10-07T16:16:06.849Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:44.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76482 (GCVE-0-2026-76482)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:16 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76482 are related to issues with improper input verification that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-347.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76482",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:43.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76482 are related to issues with improper input verification that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-347."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:16:00.719Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97297"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76482",
    "datePublished": "2026-10-07T16:16:00.719Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:43.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76480 (GCVE-0-2026-76480)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:15 – Updated: 2026-10-08 03:55

Title

Cisco License On-Prem Security Hardening Release

Summary

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76480 are related to issues with improper authentication that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-306.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 00:00 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606 Affected: 10-202608

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T03:55:42.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            },
            {
              "status": "affected",
              "version": "10-202608"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76480 are related to issues with improper authentication that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-306."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:15:52.636Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-hardening-ssm-Ph77wdhf",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"
        }
      ],
      "source": {
        "advisory": "cisco-sa-hardening-ssm-Ph77wdhf",
        "defects": [
          "CSCwv97303"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco License On-Prem Security Hardening Release"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76480",
    "datePublished": "2026-10-07T16:15:52.636Z",
    "dateReserved": "2026-08-19T12:02:03.639Z",
    "dateUpdated": "2026-10-08T03:55:42.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76454 (GCVE-0-2026-76454)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:12 – Updated: 2026-10-07 16:54

Title

Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

Summary

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 16:53 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:53:51.176135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T16:54:07.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.\r\n\r\nThis vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "Relative Path Traversal",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:31.265Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwu54774"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76454",
    "datePublished": "2026-10-07T16:12:31.265Z",
    "dateReserved": "2026-08-19T12:02:03.636Z",
    "dateUpdated": "2026-10-07T16:54:07.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76437 (GCVE-0-2026-76437)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:12 – Updated: 2026-10-07 18:05

Title

Cisco Smart Software Manager On-Prem Command Injection Vulnerability

Summary

A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 17:58 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T17:58:37.739575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T18:05:43.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.\r\n\r\nThis vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with\u0026nbsp;root privileges.\r\nTo exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:22.493Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53807"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76437",
    "datePublished": "2026-10-07T16:12:22.493Z",
    "dateReserved": "2026-08-19T12:02:03.635Z",
    "dateUpdated": "2026-10-07T18:05:43.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76452 (GCVE-0-2026-76452)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:12 – Updated: 2026-10-07 17:43

Title

Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

Summary

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality. To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 17:42 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T17:42:56.759473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T17:43:19.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality.\r\nTo exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:12.545Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53814"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem SQL Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76452",
    "datePublished": "2026-10-07T16:12:12.545Z",
    "dateReserved": "2026-08-19T12:02:03.636Z",
    "dateUpdated": "2026-10-07T17:43:19.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20328 (GCVE-0-2026-20328)

Vulnerability from cvelistv5 – Published: 2026-10-07 16:12 – Updated: 2026-10-08 13:04

Title

Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

Summary

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 03:55 UTC

CWE

CWE-862 - Missing Authorization

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco License On-Prem	Affected: 7-202001 Affected: 1.1 Affected: 6.3.0 Affected: 8-202004 Affected: 8-202006 Affected: 1.2 Affected: 1.3 Affected: 8-202012 Affected: 8-202010 Affected: 8-202008 Affected: 9-202201 Affected: 8-202102 Affected: 1.4 Affected: 8-202105 Affected: 8-202108 Affected: 8-202112 Affected: 8-202201 Affected: 8-202206 Affected: 8-202212 Affected: 8-202302 Affected: 8-202303 Affected: 8-202304 Affected: 8-202308 Affected: 8-202401 Affected: 8-202404 Affected: 9-202406 Affected: 9-202407 Affected: 9-202410 Affected: 9-202412 Affected: 9-202501 Affected: 9-202502 Affected: 9-202504 Affected: 9-202507 Affected: 9-202510 Affected: 9-202601 Affected: 10-202606

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T03:55:34.596041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:04:30.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco License On-Prem",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "7-202001"
            },
            {
              "status": "affected",
              "version": "1.1"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "8-202004"
            },
            {
              "status": "affected",
              "version": "8-202006"
            },
            {
              "status": "affected",
              "version": "1.2"
            },
            {
              "status": "affected",
              "version": "1.3"
            },
            {
              "status": "affected",
              "version": "8-202012"
            },
            {
              "status": "affected",
              "version": "8-202010"
            },
            {
              "status": "affected",
              "version": "8-202008"
            },
            {
              "status": "affected",
              "version": "9-202201"
            },
            {
              "status": "affected",
              "version": "8-202102"
            },
            {
              "status": "affected",
              "version": "1.4"
            },
            {
              "status": "affected",
              "version": "8-202105"
            },
            {
              "status": "affected",
              "version": "8-202108"
            },
            {
              "status": "affected",
              "version": "8-202112"
            },
            {
              "status": "affected",
              "version": "8-202201"
            },
            {
              "status": "affected",
              "version": "8-202206"
            },
            {
              "status": "affected",
              "version": "8-202212"
            },
            {
              "status": "affected",
              "version": "8-202302"
            },
            {
              "status": "affected",
              "version": "8-202303"
            },
            {
              "status": "affected",
              "version": "8-202304"
            },
            {
              "status": "affected",
              "version": "8-202308"
            },
            {
              "status": "affected",
              "version": "8-202401"
            },
            {
              "status": "affected",
              "version": "8-202404"
            },
            {
              "status": "affected",
              "version": "9-202406"
            },
            {
              "status": "affected",
              "version": "9-202407"
            },
            {
              "status": "affected",
              "version": "9-202410"
            },
            {
              "status": "affected",
              "version": "9-202412"
            },
            {
              "status": "affected",
              "version": "9-202501"
            },
            {
              "status": "affected",
              "version": "9-202502"
            },
            {
              "status": "affected",
              "version": "9-202504"
            },
            {
              "status": "affected",
              "version": "9-202507"
            },
            {
              "status": "affected",
              "version": "9-202510"
            },
            {
              "status": "affected",
              "version": "9-202601"
            },
            {
              "status": "affected",
              "version": "10-202606"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.\r\n\r\nThis vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T16:12:04.453Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ssm-access-nttb2dhE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ssm-access-nttb2dhE",
        "defects": [
          "CSCwv53803"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20328",
    "datePublished": "2026-10-07T16:12:04.453Z",
    "dateReserved": "2025-10-08T11:59:15.412Z",
    "dateUpdated": "2026-10-08T13:04:30.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities found for Cisco License On-Prem by Cisco

CVE-2026-76484 (GCVE-0-2026-76484)

CVE-2026-76483 (GCVE-0-2026-76483)

CVE-2026-76482 (GCVE-0-2026-76482)

CVE-2026-76480 (GCVE-0-2026-76480)

CVE-2026-76454 (GCVE-0-2026-76454)

CVE-2026-76452 (GCVE-0-2026-76452)

CVE-2026-76437 (GCVE-0-2026-76437)

CVE-2026-20328 (GCVE-0-2026-20328)

CVE-2026-76484 (GCVE-0-2026-76484)

CVE-2026-76483 (GCVE-0-2026-76483)

CVE-2026-76482 (GCVE-0-2026-76482)

CVE-2026-76480 (GCVE-0-2026-76480)

CVE-2026-76454 (GCVE-0-2026-76454)

CVE-2026-76437 (GCVE-0-2026-76437)

CVE-2026-76452 (GCVE-0-2026-76452)

CVE-2026-20328 (GCVE-0-2026-20328)