Cisco License On-Prem: Arbitrary account password reset
Summary
Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has an improper check in its password reset process in the web-based management interface. An unauthenticated remote attacker can send a crafted request to reset the password of any account, including administrative accounts. This can give the attacker unauthorized access to the application as any user. No workaround exists, and the attack needs only network access to the web interface.
Affected
- Cisco License On-Prem and the legacy name Cisco SSM On-Prem, in the releases listed in the CVE record (among others 1.1, 1.2, 1.3, 6.3.0, 7-202001, 8-202004 to 8-202102, 9-202201).
- Vendor sources state that releases earlier than 10-202608 are affected. Confirm the exact list on Cisco's advisory.
- Cisco License Smart Licensing Utility is not affected, according to Cisco.
Fixed in
- Upgrade to a fixed release named in Cisco's advisory. Tenable names Cisco License On-Prem 10-202608 or later. Confirm the exact first fixed release in the advisory table before acting.
- Cisco recommends 10-202609 or later as the current version.
Workaround
- No workarounds available according to Cisco.
- Restrict access to the web management interface to a small administrative network or VPN, and do not expose it to the internet. This is a temporary measure only and does not replace patching.
Exploitation
- Cisco PSIRT is not aware of public announcements or malicious use of this vulnerability.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No public proof of concept was found in the research. This was not verified against GitHub or researcher write-ups.
Our recommendation
- Check whether any Cisco License On-Prem or SSM On-Prem server is reachable from outside your network and remove any internet exposure.
- Patch to the fixed release confirmed in Cisco's advisory as soon as possible.
- Review administrator accounts and recent password resets for unexpected changes.
- Rotate administrator credentials after patching.
- Monitor the web management interface logs and watch for updates from Cisco and CISA.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-ssm-access-nttb2dhE sec.cloudapps.cisco.com
- eSecurityPlanet: Cisco Smart Software Manager On-Prem critical flaws www.esecurityplanet.com
- Tenable plugin 364455 www.tenable.com
- Secure-ISS: Cisco NX-OS, License On-Prem, APIC and Meraki critical vulnerabilities www.secure-iss.com
- BleepingComputer: Cisco SSM On-Prem bug lets hackers change any user's password www.bleepingcomputer.com
- Strix AI: CVE-2026-20328 www.strix.ai
- ThreatInt: CVE-2026-20328 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:17.
Original description (NVD)
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.