Cisco License On-Prem: Unauthenticated Admin Reset and Eight Fixes

On 7 October 2026 Cisco published two Critical advisories for Cisco License On-Prem, the on-premises licensing server formerly called Cisco Smart Software Manager On-Prem (SSM On-Prem). Together they fix eight vulnerabilities. The most direct one, CVE-2026-20328, lets an unauthenticated, remote attacker reset the password of any account, including administrators, through the web management interface.

Cisco says there are no workarounds for either advisory and that its PSIRT is not aware of public announcements or malicious use. CISA's enrichment on the two most severe externally reported CVEs marks them as automatable with total technical impact. This is a server that sits on the management network of a lot of Cisco estates, and it is easy to forget it exists until a license sync breaks.

What's affected

Advisory cisco-sa-ssm-access-nttb2dhE (four CVEs, externally reported):

Cisco credits Gabriele Paris of the NATO Cyber Security Centre for CVE-2026-20328, CVE-2026-76437 and CVE-2026-76452, and Trung Nguyen of CyStack for CVE-2026-76454. The advisory notes the four are independent, so a release affected by one may not be affected by the others. All License On-Prem configurations are affected, and releases from the SSM On-Prem era are included. Cisco Smart Licensing Utility itself is confirmed not affected.

Advisory cisco-sa-hardening-ssm-Ph77wdhf, the October 2026 security hardening release (four CVEs, found internally):

• CVE-2026-76482: improper verification of a cryptographic signature (CWE-347), CVSS 10.0
• CVE-2026-76480: missing authentication for a critical function (CWE-306), CVSS 9.8
• CVE-2026-76483: insufficiently protected credentials (CWE-522), CVSS 9.1
• CVE-2026-76484: code injection (CWE-94), CVSS 8.8

Cisco notes that each score in the hardening advisory reflects the most severe issue in its CWE group, and that the issues "were found during internal security testing using existing testing processes as well as frontier AI models."

Fixed releases. The two advisories have different first fixed releases, which is the detail most likely to trip up a patch plan:

If you upgrade to 10-202608 to close the password reset, you are still exposed to the hardening release CVEs. 10-202609 is the release that covers both.

How to check if you're exposed

Neither advisory gives version check steps, so use the release shown in the License On-Prem administration interface, or your change records from the last upgrade. Anything at 9-202601 or earlier, or below 10-202609, is affected by at least one of the two advisories.

Then check who can reach it. Both of the most severe externally reported bugs are pre-authentication, so reachability is the real exposure:

# Run from a workstation subnet and from any DMZ that should not have access.
# Set WEBUI_PORT to the port your License On-Prem web interface and API listen on.
nmap -Pn -p "$WEBUI_PORT" license-onprem.example.internal

Also review the local accounts on the server. CVE-2026-20328 resets passwords, so an unexplained password change on an administrator account, or a lockout of a legitimate admin, is a signal worth investigating.

What to do now

1. Upgrade to 10-202609. It is listed as not vulnerable in both advisories. If you are on 9-202601 or earlier, follow the release notes for migrating to the 10 line first.
2. Do not stop at 10-202608. It fixes the externally reported four but not the hardening release CVEs.
3. Restrict access to the web interface and API to the administrators and devices that need it. A licensing server rarely needs to be reachable from user networks.
4. Reset administrator passwords and review accounts after upgrading if the server was reachable from untrusted networks. A password reset bug leaves no trace in the software version.
5. Rotate credentials stored on the server, given CVE-2026-76483 (insufficiently protected credentials), if you cannot rule out access.
6. Add License On-Prem to your vulnerability inventory as its own asset, with an owner. It is easy to treat as part of "the Cisco stuff" and miss.

Why it matters

Back office infrastructure servers, such as licensing, update and inventory servers, tend to be deployed once, configured once and then left alone. They hold credentials, talk to many devices, and are rarely in anyone's patch rota. A pre-auth admin takeover on one of them is a quiet foothold on the management network.

The split fix versions are the practical lesson. Vendors increasingly publish several advisories for one product on the same day, each with its own fixed release table. Read them together and pick the release that clears all of them, rather than closing tickets one advisory at a time.

Try it yourself

List every vendor-supplied management server you run that is not a network device or a hypervisor: licensing, update, telemetry and inventory servers. For each, write down its version and who can reach its web interface. Any row where you do not know either answer is a candidate for this kind of advisory going unnoticed.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Cisco Security Advisory: Cisco License (Smart Software Manager) On-Prem Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)
• Cisco Security Advisory: Cisco License (Smart Software Manager) On-Prem Security Hardening Release, October 2026 (cisco-sa-hardening-ssm-Ph77wdhf)
• CVE-2026-20328 record (cve.org)
• CVE-2026-76454 record (cve.org)