Cisco License On-Prem CVE-2026-76437

Exploitation requires valid administrative (system administrator) credentials for the Cisco License On-Prem web-based management interface - the description explicitly states the attacker must already hold admin privileges (reflected as PR:H). The specific trigger is submitting a configuration update whose user-supplied content is improperly validated, allowing OS command injection (CWE-78) executed with root privileges. Limiting factors: network reachability to the management interface is required, and because the attacker must already be a system administrator the only additional capability gained is the ability to shut down the underlying OS (modeled as A:H, with C:N/I:N); this high authentication bar substantially constrains real-world risk despite the root-level command execution.

This is a high-CVSS-concept but genuinely low-real-risk issue, and the signals are internally consistent. The CVSS 3.1 base score is only 4.9 (Medium) despite OS command execution as root, because the vector scopes impact to availability alone (C:N/I:N/A:H): exploitation requires PR:H (valid system administrator credentials per the description), and such an administrator already controls the application, so the only net-new capability is the ability to shut down the host - hence no additional confidentiality or integrity impact in the vendor's modeling. Attack vector is network (AV:N), complexity low (AC:L), no user interaction (UI:N), scope unchanged. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was identified at time of analysis - there is no public exploit identified. The dominant limiting factor is the prerequisite of pre-existing administrative access, which converts this from a remote-takeover scenario into a post-authentication privilege nuance. Prioritize patching below internet-facing unauthenticated flaws, but do patch, since an admin-to-root OS boundary is still a meaningful trust-boundary crossing on an appliance.

An attacker who has already obtained valid administrator credentials for the Cisco License On-Prem web management interface submits a maliciously crafted configuration update containing OS command metacharacters, which the interface fails to validate. The injected content is passed to the underlying operating system and executed with root privileges. No public exploit code was identified at time of analysis, and network reachability to the management interface plus administrative authentication are both required.