Cisco License On-Prem: Missing authentication for critical function

Summary

Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), contains a missing authentication check on a critical function (CWE-306). The flaw is part of a security hardening release covering four CVEs in advisory cisco-sa-hardening-ssm-Ph77wdhf. An unauthenticated attacker who can reach the service over the network could access functions that should be protected, with a CVSS base score of 9.8. Cisco reports no known exploitation and no workaround.

Affected

• Cisco License On-Prem 9-202601 and earlier (formerly Cisco SSM On-Prem), according to the advisory fixed-release table
• Cisco License On-Prem 10-202608 and earlier, according to the advisory fixed-release table
• The CVE record also lists older releases (for example 7-202001, 8-202004 to 8-202102, 9-202201), all regardless of software configuration
• Not affected: Cisco Smart Licensing Utility

Fixed in

• First fixed release: 10-202609 (per the Cisco advisory fixed-release table)
• Cisco License On-Prem 10-202609 and later: not vulnerable
• Releases 9-202601 and earlier: migrate to a fixed release as described in the Cisco release notes

Workaround

Unknown. Cisco states that no workarounds are available. Patching or migrating to a fixed release is the only remediation.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No public proof-of-concept found in the sources reviewed.

Our recommendation

• Inventory all Cisco License On-Prem and SSM On-Prem instances and record their versions.
• Check whether the web interface and API are reachable from untrusted networks, and restrict access to management networks.
• Upgrade or migrate to 10-202609 or later as directed by Cisco, after verifying the exact build in the advisory.
• After patching, review access logs and administrative accounts for unexpected changes. If the server was internet-reachable, rotate administrative credentials as a precaution.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-ssm-Ph77wdhf sec.cloudapps.cisco.com
• OpenCVE CVE-2026-76480 app.opencve.io
• CIRCL CVE-2026-76480 vulners.com
• Rapid7 record mirror CVE-2026-76480 vulners.com
• OpenCVE CVE-2026-76482 (sister CVE in same advisory) app.opencve.io
• Security Online: Cisco License On-Prem vulnerabilities (secondary) securityonline.info
• BestAntivirusPro: Cisco SSM vulnerabilities (secondary) bestantiviruspro.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:45.