SB2026100922 - Multiple vulnerabilities in Cisco License On-Prem (formerly Smart Software Manager)
Published: October 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-76480)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, modify protected information, and cause a denial of service.
The vulnerability exists due to missing authentication for critical functions in Cisco License On-Prem when critical functions are accessed over the network. A remote attacker can access critical functions without authentication to disclose sensitive information, modify protected information, and cause a denial of service.
The issue is present regardless of software configuration. No user interaction is required.
2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-76482)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, modify protected information, and cause a denial of service.
The vulnerability exists due to improper verification of cryptographic signatures in Cisco License On-Prem when cryptographic signatures are verified. A remote attacker can exploit improper signature verification over the network to disclose sensitive information, modify protected information, and cause a denial of service.
The issue is present regardless of software configuration. No user interaction is required. The assessed impact can extend beyond the vulnerable component's security authority.
3) Insufficiently protected credentials (CVE-ID: CVE-2026-76483)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and modify protected information.
The vulnerability exists due to insufficient protection of credentials in Cisco License On-Prem when credentials are handled. A remote attacker can exploit insufficient credential protection over the network to disclose sensitive information and modify protected information.
The issue is present regardless of software configuration. No user interaction is required.
4) Code Injection (CVE-ID: CVE-2026-76484)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Cisco License On-Prem when code is generated. A remote user can exploit code injection over the network to execute arbitrary code.
The issue is present regardless of software configuration. No user interaction is required.
Remediation
Install update from vendor's website.