Cisco License On-Prem EUVD-2026-94448

Exploitation requires only network reachability to the web-based management interface of Cisco License On-Prem / Smart Software Manager On-Prem (SSM On-Prem); the specific prerequisite is the ability to send a request to the password-reset functionality of that interface, which performs improper checks (CWE-862 Missing Authorization) during the reset process. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special privileges, and no user interaction are needed against a reachable instance. The practical limiting factor is exposure: the management interface must be network-accessible to the attacker, so instances restricted to isolated management networks or protected behind access controls are materially harder to reach, which should temper real-world risk relative to the raw 9.1 score for well-segmented deployments.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk paper cut. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible exposure profile: a network-reachable, low-complexity attack requiring no privileges and no user interaction, confirmed by the vendor (Cisco) as allowing an unauthenticated remote attacker to reset the password of any account - including high-privileged administrators - and thereby gain full application access. The 9.1 score with C:H/I:H/A:N is consistent with an authentication/authorization bypass (CWE-862 Missing Authorization) that yields confidentiality and integrity impact but not service disruption. However, several enrichment signals are MISSING rather than negative: no EPSS exploitation-probability score was provided, no CISA KEV listing is present in the input, no SSVC decision data was supplied, and no proof-of-concept is referenced. The only source is the Cisco security advisory itself. Therefore the real-world urgency rests on the vendor-confirmed severity and the trivially-exploitable vector, not on any evidence of active exploitation or available exploit code. The absence of EPSS/KEV/POC should be read as 'not yet known,' not as 'low risk' - a trivial unauthenticated admin-takeover flaw in an enterprise Cisco product is exactly the class that tends to attract exploitation quickly, so it warrants prompt patching even without current exploitation evidence.

An unauthenticated attacker who can reach the web-based management interface of a Cisco License On-Prem (SSM On-Prem) deployment sends a crafted request that abuses the flawed password-reset logic to reset the password of a known administrative account. Having set a password they control, the attacker logs in as that administrator and gains full unauthorized access to the application. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) and lack of required privileges or user interaction make reliable exploitation straightforward once the request structure is known.