Cisco License On-Prem: Unauthenticated arbitrary file write in management API
Summary
Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), contains a flaw in its management API. An unauthenticated remote attacker can send a crafted request to write arbitrary files to the system or cause a denial of service. Cisco says the flaw is caused by improper input validation and missing authentication, and that the standalone Smart Licensing Utility is not affected.
Affected
- Cisco License On-Prem, regardless of configuration (formerly SSM On-Prem).
- SSM On-Prem 9-202601 and earlier, according to secondary reporting.
- Exact list of affected 10-series releases: unverified, see the Cisco advisory. Secondary reporting says releases earlier than 10-202608.
Fixed in
- 9-series: migrate to a fixed release. The exact version is not confirmed in the advisory excerpt.
- 10-series: 10-202608 according to secondary reporting. Verify in the Cisco advisory table. The companion hardening release 10-202609 is also referenced.
Workaround
- None. Cisco states that no workarounds address this vulnerability.
- Interim measure (own assessment, not from the vendor): restrict network access to the management interface and API to trusted administrator hosts only.
Exploitation
- Cisco PSIRT is not aware of public announcements or malicious use of the vulnerabilities in the advisory.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No public proof of concept found in research. This is a search gap, not proof that none exists.
Our recommendation
- Identify all License On-Prem and SSM On-Prem instances and check whether they are reachable from untrusted networks.
- Restrict access to the management interface and API to trusted administrator hosts now.
- Apply the fixed release from the Cisco advisory as soon as possible, including the 9-series migration where applicable.
- Monitor logs for unexpected API requests and file changes, and check GitHub and CISA KEV for new exploit reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-ssm-access-nttb2dhE sec.cloudapps.cisco.com
- Cisco advisory (cisco.com mirror) www.cisco.com
- Cisco License On-Prem 10-202609 Release Notes www.cisco.com
- eSecurityPlanet: Cisco SSM On-Prem critical flaws www.esecurityplanet.com
- Secure-ISS: Cisco License On-Prem critical vulnerabilities www.secure-iss.com
- OpenCVE: CVE-2026-76454 app.opencve.io
- Strix: CVE-2026-76454 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:16.
Original description (NVD)
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.