Cisco License On-Prem EUVD-2026-94454

Exploitation requires network reachability to the Cisco Smart Licensing Utility management API exposed by Cisco License On-Prem / SSM On-Prem; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required, because the management API itself lacks authentication and performs improper input validation. The primary limiting factor is therefore network exposure: the main realistic mitigation is restricting access to the management API (segmentation, ACLs, or not exposing it to untrusted networks). The affected version range is unconfirmed beyond the wildcard CPE, so defenders should confirm which deployed versions are vulnerable against the Cisco advisory.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible exposure profile: network-reachable, low attack complexity, no privileges, and no user interaction - meaning any attacker who can reach the Smart Licensing Utility management API can attempt exploitation. The impact profile (C:N/I:H/A:H) is consistent with the description: arbitrary file write (high integrity impact) and a DoS condition (high availability impact), with no direct confidentiality loss, which correctly explains the 9.1 rather than a perfect 10. Tempering factors: no EPSS score is provided, so statistical exploitation probability cannot be quantified; the CVE is NOT listed in CISA KEV and NO public proof-of-concept is referenced, so there is currently no public-exploit or active-exploitation signal. The signals are therefore internally consistent (vendor-reported critical flaw, trivial exploit prerequisites) but the real-world urgency signals (EPSS/KEV/POC) are simply absent rather than conflicting. Given that arbitrary file write by an unauthenticated remote attacker frequently escalates to remote code execution, defenders should treat this as a patch-urgently issue despite the lack of exploitation telemetry.

An unauthenticated attacker who can reach the Cisco License On-Prem (formerly SSM On-Prem) management API over the network sends a single crafted HTTP request that abuses improper input validation (CWE-23, relative path traversal) to write an arbitrary file to the host. By overwriting a sensitive system or application file - or flooding writes to exhaust resources - the attacker corrupts the application (DoS) and potentially stages follow-on code execution. No public proof-of-concept is identified at time of analysis, and the low attack complexity means no special timing or race conditions are required.