---
id: CVE-2026-76454
title: >-
  A vulnerability in the Cisco Smart Licensing Utility API of Cisco License
  On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could
  allow an unauthenticated, remote attacker to write arbitrary files to the
  system or cau…
summary: >-
  A vulnerability in the Cisco Smart Licensing Utility API of Cisco License
  On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could
  allow an unauthenticated, remote attacker to write arbitrary files to the
  system or cau…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-23
vendor: Cisco
product: Cisco License On-Prem
affected:
  - license_on-prem 7-202001
  - license_on-prem 1.1
  - license_on-prem 6.3.0
  - license_on-prem 8-202004
  - license_on-prem 8-202006
  - license_on-prem 1.2
  - license_on-prem 1.3
  - license_on-prem 8-202012
  - license_on-prem 8-202010
  - license_on-prem 8-202008
  - license_on-prem 9-202201
  - license_on-prem 8-202102
  - license_on-prem 1.4
  - license_on-prem 8-202105
  - license_on-prem 8-202108
  - license_on-prem 8-202112
  - license_on-prem 8-202201
  - license_on-prem 8-202206
  - license_on-prem 8-202212
  - license_on-prem 8-202302
  - license_on-prem 8-202303
  - license_on-prem 8-202304
  - license_on-prem 8-202308
  - license_on-prem 8-202401
  - license_on-prem 8-202404
  - license_on-prem 9-202406
  - license_on-prem 9-202407
  - license_on-prem 9-202410
  - license_on-prem 9-202412
  - license_on-prem 9-202501
  - license_on-prem 9-202502
  - license_on-prem 9-202504
  - license_on-prem 9-202507
  - license_on-prem 9-202510
  - license_on-prem 9-202601
  - license_on-prem 10-202606
published: '2026-10-07'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T17:16:57.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76454'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE
    label: psirt@cisco.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-07T16:53:51.176135Z'
ingestedAt: '2026-10-07T16:38:22.253Z'
---

## Overview

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.

This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.