Code Injection in Cisco License On-Prem (formerly Cisco Smart Software Manager) - CVE-2026-76484
Published: October 9, 2026
Vulnerability identifier: #VU154032
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76484
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Cisco License On-Prem when code is generated. A remote user can exploit code injection over the network to execute arbitrary code.
The issue is present regardless of software configuration. No user interaction is required.
Affected software
Cisco License On-Prem (formerly Cisco Smart Software Manager)
How to mitigate CVE-2026-76484
Install security update from vendor's website.
Cisco License On-Prem (formerly Cisco Smart Software Manager) - update to 10-202609