Command injection in Cisco License On-Prem (formerly Cisco Smart Software Manager) - CVE-2026-76437
Published: October 9, 2026
Vulnerability identifier: #VU154027
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76437
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary operating system commands with root privileges.
The vulnerability exists due to command injection caused by improper validation of user-supplied configuration content in the web-based management interface when processing configuration updates. A remote privileged user can submit crafted configuration updates to execute arbitrary operating system commands with root privileges.
The only additional capability beyond existing system administrator permissions is shutting down the system.
Affected software
Cisco License On-Prem (formerly Cisco Smart Software Manager)
How to mitigate CVE-2026-76437
Install security update from vendor's website.
Cisco License On-Prem (formerly Cisco Smart Software Manager) - update to 10-202608