Cisco License On-Prem EUVD-2026-94464

Exploitation requires network reachability to the Cisco License On-Prem (formerly Smart Software Manager On-Prem) management service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special configuration prerequisites, no authentication, and no user interaction required against an exposed instance, consistent with CWE-306 missing authentication on a critical function. The primary limiting factor is network exposure: SSM On-Prem is typically an internal licensing server, so risk is substantially reduced where the management interface is restricted to trusted management networks and not internet-facing. Exact vulnerable versions were not provided in the input and should be confirmed against the Cisco advisory to scope affected deployments.

All available signals point to a genuine high-priority issue, though some corroborating data is absent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, and CWE-306 (Missing Authentication for a Critical Function) is consistent with the 'Authentication Bypass' tag - the signals are internally coherent, not conflicting. The 9.8 base score combined with full H/H/H impact indicates complete compromise of confidentiality, integrity, and availability. However, no EPSS probability was supplied, there is no CISA KEV listing, and no public exploit code was referenced, so there is no public exploit identified at time of analysis. The vulnerability was internally discovered and reported by Cisco itself as part of a proactive hardening review rather than being found through observed attacks, which lowers the likelihood of in-the-wild exploitation in the immediate term but does NOT reduce the technical severity. Bottom line: treat as a real priority for patching because of the trivial-to-exploit, unauthenticated, network-facing nature, while recognizing that current evidence shows no active exploitation - EPSS and KEV data are missing and should be re-checked, as auth-bypass flaws in licensing/management infrastructure are attractive reverse-engineering targets once patches are released.

An attacker with network access to the Cisco License On-Prem (SSM On-Prem) management interface sends a request to a function that fails to enforce authentication, bypassing login entirely. Because no credentials or user interaction are required, the attacker gains unauthorized access that can lead to full read/write control and disruption of the licensing server. No public proof-of-concept was referenced in the provided data.