Cisco License On-Prem EUVD-2026-94466

The attacker needs network access to the Cisco License On-Prem (formerly Smart Software Manager On-Prem) appliance's management/service interface; per CVSS PR:N/UI:N the flaw is reachable without authentication or user interaction against the affected software. The concrete prerequisite - which specific feature, protocol, or stored-credential store is exposed - is NOT specified in the vendor description beyond the CWE-522 'insufficiently protected credentials' classification, so the exact enabling configuration cannot be named from available data. Limiting factors: exploitation requires reachability to the on-prem appliance (typically an internal/management-network host rather than internet-facing), and affected/fixed version boundaries are defined only in the Cisco advisory, so patched or network-segmented deployments are not exposed.

Cisco assigns this a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges or user interaction, with high confidentiality and integrity impact but no availability impact - a profile consistent with remote unauthenticated exposure of protected credentials (CWE-522). On signal strength: the vector alone argues for high priority because unauthenticated network access to credential material can cascade into broader compromise. However, key exploitation signals are MISSING: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no evidence of active or probable exploitation at this time. The advisory framing is also notable - this CVE stems from a vendor-initiated internal security review and hardening release rather than external discovery or observed attacks, which typically correlates with lower immediate real-world exploitation. The description is deliberately vague ('issues with insufficiently protected credentials grouped under CWE-522'), so the exact attack vector and whether AV:N truly applies to every sub-issue cannot be independently confirmed from the available data - the CVSS:I:H rating in particular is hard to reconcile with a pure credential-disclosure weakness and should be verified against the Cisco advisory. Net: treat as a legitimate high-severity patch-soon item for organizations running the affected appliance, but current evidence points to no known exploitation rather than widespread active threat.

A remote, unauthenticated attacker with network reachability to the Cisco License On-Prem management interface leverages the insufficiently-protected-credentials weakness to retrieve stored or transmitted credential material (e.g., service account or integration credentials). Those harvested credentials are then reused to authenticate to the appliance or connected systems, expanding access. No public exploit code is identified at time of analysis, and the precise triggering mechanism is not disclosed in the vendor advisory.