Cisco License On-Prem EUVD-2026-94465

Exploitation targets the server's cryptographic signature verification (CWE-347) of tokens - consistent with the 'Jwt Attack' tag, a crafted JWT whose signature is not properly validated is accepted as authentic. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and low complexity are required against a network-reachable Cisco License On-Prem / SSM On-Prem instance. The primary limiting factor is network exposure: risk is concentrated where the management/licensing interface is reachable by the attacker (internet-facing or lateral network access), and the precise affected versions are not specified in the available data, so instances already on the hardening release are not vulnerable.

All severity signals point to maximum theoretical risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a perfect 10.0, indicating remote, unauthenticated, low-complexity exploitation with a scope change and total compromise of confidentiality, integrity, and availability. CWE-347 (improper verification of a cryptographic signature) combined with the 'Jwt Attack' tag strongly implies a JWT/token signature-verification bypass enabling authentication bypass. However, the real-world exploitation signals are notably absent or unverified: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept was provided - so there is no public exploit identified at time of analysis. The CVE text is also unusually vague ('improper input verification grouped under CWE-347' across 'multiple internally discovered vulnerabilities'), meaning the 10.0 reflects a vendor worst-case grouping from an internal security review rather than observed attacks. Net: treat as a high-priority patch item because the product is a trust/licensing authority and the flaw class is auth-bypass-shaped, but note that no evidence of active or at-scale exploitation exists yet, so the practical risk today is driven by exposure (internet-reachable instances) rather than confirmed weaponization.

An unauthenticated attacker with network reach to a Cisco License On-Prem (SSM On-Prem) instance forges or tampers with a JWT whose signature is improperly verified, causing the server to accept the attacker as a trusted/administrative identity. With the authentication boundary bypassed and a scope change in play, the attacker reads sensitive licensing/identity data and manipulates the server. No public proof-of-concept is currently identified, so exploitation would require independent weaponization of the signature-verification flaw.