Cisco released security updates on Oct. 7, 2026, for eight vulnerability groups and flaws affecting Cisco License On-Prem, formerly known as Smart Software Manager On-Prem (SSM On-Prem). The most severe, CVE-2026-76482, carries the maximum CVSS score of 10.0 and involves improper verification of cryptographic signatures.
The flaw has a network-based attack vector and requires neither authentication nor user interaction. Other vulnerabilities could allow attackers to bypass authentication, access sensitive information, execute commands, or disrupt the licensing application.
Cisco published two security advisories covering the vulnerabilities, with different fixed-release requirements. Administrators should check their installed versions against both advisories before upgrading.
Eight Cisco License On-Prem vulnerabilities disclosed
Cisco's October security hardening advisory identifies four vulnerability classes discovered through internal security testing.
Each class has one CVE identifier, with its CVSS score reflecting the most severe underlying issue in that category:
- CVE-2026-76482 (CVSS 10.0): Improper verification of a cryptographic signature.
- CVE-2026-76480 (CVSS 9.8): Missing authentication for a critical function.
- CVE-2026-76483 (CVSS 9.1): Insufficient protection of credentials.
- CVE-2026-76484 (CVSS 8.8): Improper control of code generation, potentially allowing code injection.
Cisco said its engineers discovered the issues using established internal security testing alongside frontier AI models.
The company grouped related findings by vulnerability class to streamline disclosure and remediation. The severity scores do not necessarily apply to every individual weakness within each group.
A second Cisco advisory, also published Oct. 7, details four additional vulnerabilities affecting the product's web management interface and APIs:
- CVE-2026-20328: An arbitrary account password-reset vulnerability that could allow unauthorized access.
- CVE-2026-76454: An unauthenticated API vulnerability that could allow arbitrary file writes or denial of service.
- CVE-2026-76437: A command-injection flaw that could allow an authenticated attacker to execute operating-system commands.
- CVE-2026-76452: A SQL-injection vulnerability that could allow an authenticated attacker to execute malicious database queries.
Cisco credits Gabriele Paris of the NATO Cyber Security Centre with reporting CVE-2026-20328, CVE-2026-76437, and CVE-2026-76452. Trung Nguyen of CyStack reported CVE-2026-76454.
Neither advisory reports known malicious exploitation, and Cisco says no workarounds address the vulnerabilities.
Which Cisco releases are affected?
Both advisories cover Cisco License On-Prem regardless of software configuration. Older installations using the Smart Software Manager On-Prem name are also affected.
The hardening advisory identifies these remediation requirements:
- Release 10-202608 and earlier in the 10-series: Upgrade to 10-202609 or a later fixed release.
- Release 9-202601 and earlier: Migrate to a fixed release.
- Release 10-202609: Not vulnerable to the hardening issues.
The web/API advisory has a different fixed-release table. It identifies 10-202608 as the first fixed release for earlier affected 10-series versions and directs older 9-series installations to migrate.
Because release 10-202609 addresses the hardening issues and is also listed as not vulnerable in the companion advisory, it is the relevant fixed version for administrators moving to the current 10-series release. Upgrade paths should still follow Cisco's release notes.
Cisco has confirmed that the separate Cisco Smart Licensing Utility product is not affected by the hardening vulnerabilities. The similarly named Smart Licensing Utility API described in the companion advisory is part of the affected License On-Prem application, not proof that the standalone utility is vulnerable.
Administrators should identify the exact product and installed release before determining exposure.
What administrators should do
Cisco recommends upgrading or migrating to fixed software. Organizations running older SSM On-Prem versions may need to follow a migration path rather than installing a routine update.
Security and IT teams should:
- Inventory installations. Identify Cisco License On-Prem and legacy SSM On-Prem instances, including their exact software releases.
- Check the applicable fixes. Review both Cisco advisories and confirm the upgrade or migration path for each installation.
- Schedule remediation. Obtain the appropriate fixed software and follow Cisco's published upgrade instructions.
- Verify the result. Confirm the installed version after the change and review access to the application's management interface.
Cisco also patched an earlier SSM On-Prem command-execution vulnerability, CVE-2026-20160, in April. That flaw carried a CVSS score of 9.8 and could allow unauthenticated attackers to execute operating-system commands with root privileges.
For organizations handling multiple infrastructure vulnerabilities, vulnerability management tools can help maintain an inventory of affected systems, while patch management processes help track remediation.
The immediate priority for Cisco License On-Prem deployments is to confirm the installed version and follow the applicable fixed-release guidance. Cisco has issued updates, but neither October advisory provides a workaround for organizations that remain on vulnerable software.
Also read: Dell recently disclosed two maximum-severity storage vulnerabilities that could expose administrator credentials and compromise enterprise storage systems.