Cisco License On-Prem CVE-2026-76484

Exploitation requires valid low-privilege authenticated access to the Cisco License On-Prem (formerly Smart Software Manager On-Prem) management interface, per CVSS PR:L - it is not fully unauthenticated. No user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factors are the need for a valid account on the appliance and the appliance's typically restricted/internal management-network exposure; the exact feature or endpoint hosting the code-injection flaw is not disclosed in the bundled hardening advisory and should be confirmed with Cisco.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity code-injection flaw (CWE-94) requiring only low-privilege authentication, with full H/H/H impact yielding RCE on the Cisco License On-Prem appliance - a legitimately serious combination consistent with the 8.8 (High) base score. However, the risk signals are thin: no EPSS probability, no CISA KEV listing, and no public exploit code are present in the input, and Cisco explicitly frames this as the product of a proactive internal security review rather than a response to observed attacks. That framing, combined with the absence of KEV/POC, points to no known active exploitation and likely no public exploit at this time, so this is a 'patch on a normal priority cycle' item rather than an emergency. One caveat: the description is a bundled hardening advisory covering multiple internally discovered CWE-94 issues, so the exact injection point and whether PR:L is accurate for every grouped issue cannot be verified from the input - confirm specifics against the Cisco advisory. Prioritize because authenticated RCE on a licensing appliance is high-impact, but there is no evidence this is being exploited in the wild.

An attacker who already holds a valid low-privilege account on the Cisco License On-Prem web interface submits crafted input to a vulnerable endpoint that fails to sanitize code/commands, causing the appliance to execute attacker-controlled code. Because the attack is network-based and low-complexity, a single authenticated request over the management network can yield remote code execution with full confidentiality, integrity, and availability impact. No public proof-of-concept is identified at time of analysis, and no special user interaction is required.