Cisco License On-Prem EUVD-2026-94450

Exploitation requires valid administrative user credentials on the affected Cisco License On-Prem (formerly SSM On-Prem) application - the description explicitly states this, and the CVSS PR:H reflects it. The attacker targets the web-based management interface, sending a crafted request to a field that insufficiently validates user-supplied input (CWE-89). Limiting factors: the attacker must first authenticate as an administrator, so this is not reachable by anonymous or low-privileged users; impact is confined to unauthorized reading of internal database contents (no write/integrity or availability impact). No special non-default feature or configuration is named - the flaw affects the standard web management interface, but the high-privilege gate substantially narrows the realistic attacker population to insiders or those with stolen admin credentials.

This is a genuine-but-moderate-priority issue, correctly rated CVSS 4.9 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: exploitation is network-reachable (AV:N) and low-complexity (AC:L) but gated behind high privileges (PR:H), which the description confirms by stating the attacker must already hold valid administrative user credentials. Impact is confidentiality-only (C:H/I:N/A:N) - the flaw lets an authenticated admin read internal database contents that should be off-limits even to administrative users, i.e. a privilege/trust-boundary bypass within the app rather than a data breach from an outside attacker. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation: no public exploit identified at time of analysis. The PR:H requirement is the dominant risk-limiting factor - this is not a mass-exploitable, unauthenticated flaw, and real-world risk is largely confined to insider misuse or scenarios where admin credentials are already compromised. No signals conflict; the main gap is the absence of exploitation-probability data (EPSS) and any public exploit status.

An attacker who already possesses valid administrative credentials for the Cisco License On-Prem web management interface sends a crafted request containing malicious SQL to an input field that is insufficiently validated. The injected query returns internal database contents that the application is designed to hide even from administrators, giving the attacker unauthorized read access to sensitive stored data. No public proof-of-concept was identified in the provided data.