CVE-2026-76454 is a critical (CVSS 9.1) flaw in the Smart Licensing Utility API of Cisco License On-Prem, formerly SSM On-Prem. An unauthenticated remote attacker could write arbitrary files or cause a denial of service. Cisco has no workaround. Upgrade to release 10-202608 or later.
What's affected
- Product: Cisco License On-Prem, formerly Cisco Smart Software Manager (SSM) On-Prem.
- Affected: all releases earlier than 10-202608, regardless of configuration. Releases 9-202601 and earlier, which were called SSM On-Prem, are also affected and need to migrate to a fixed release.
- Fixed: 10-202608. Release 10-202609 is listed as not vulnerable.
- Weakness: CWE-23, relative path traversal.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. - Cisco says it is not aware of public announcements or malicious use. Not listed in CISA KEV. Cisco Smart Licensing Utility is confirmed not affected.
The same Cisco advisory covers three other CVEs for this product: CVE-2026-20328, CVE-2026-76437 and CVE-2026-76452. One upgrade handles all four.
How to check if you're exposed
Check the release shown in the License On-Prem web interface, or in the release information of your deployment, and compare it with 10-202608.
Then find out who can reach the service. This is an on-premises licensing server, so it is usually only visible from inside the network, but check for any firewall rule or reverse proxy that exposes its management interface or API to a wider audience.
Look at the host for unexpected recent file changes and for crashes or restarts of the application, since the record names file writes and denial of service as the outcomes.
What to do now
- Identify every License On-Prem or SSM On-Prem instance and its release.
- Upgrade to 10-202608 or later. For 9-202601 and earlier, follow Cisco's migration guidance to a fixed release.
- Restrict network access to the management interface and API to administrators and the devices that need it.
- Review the host for unexpected file changes, and rotate credentials if anything looks off.
- Read the Cisco advisory for the other three CVEs and confirm the new release covers them.
Why it matters
The advisory ties this issue to improper input validation and a lack of authentication in the management API. The weakness class is relative path traversal, which means input can influence where a file is written. Combined with no authentication, a network reachable API can change files on the system.
Licensing servers are easy to forget. They sit in the middle of many networks, they hold device and account data, and they rarely get the attention of an edge system. Put them on your patch list.
Quick check
Is there a workaround?
Cisco states there are no workarounds. Upgrade, and limit who can reach the service while you plan it.
Does this affect the Smart Licensing Utility client?
Cisco confirms that Cisco Smart Licensing Utility is not affected. The flaw is in the On-Prem server API.
Sources
Last reviewed: 19 October 2026.
