Act nowDisclosed

Advisory · CVE-2026-20328

Cisco License On-Prem password reset flaw lets attackers seize any account

An unauthenticated attacker can abuse improper checks in the Cisco License On-Prem password reset process to reset the password of any account, including administrators.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco License On-Prem
Identifier / CWE
CVE-2026-20328
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

The sign-in page has a password-reset door with a broken lock. Anyone on the internet can walk up, point at any account including the boss's, and change its password.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious request

    An unauthenticated, remote attacker sends a crafted request to the web-based management interface of Cisco License On-Prem.

  2. 02Reset checks bypassed

    Improper checks during the password reset process let the request target an arbitrary account instead of the attacker's own.

  3. 03Password overwritten

    The application resets the password of the chosen account, including high-privileged administrative accounts.

  4. 04Full access

    The attacker signs in as the compromised user and gains unauthorized access to the application as any user.

What happened

Cisco disclosed CVE-2026-20328 on October 7, 2026, rating it Critical with a CVSS base score of 9.1. The flaw is in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem). Improper checks during the password reset process allow an unauthenticated, remote attacker to reset the password of an arbitrary account, including high-privileged administrative accounts.

Cisco states it has released software updates that address the vulnerability and that there are no workarounds. Cisco PSIRT is not aware of malicious use of the vulnerability at the time of the advisory.

What to do

  1. Identify every Cisco License On-Prem / SSM On-Prem deployment in your environment; the vulnerable product list is not configuration-dependent.
  2. Apply the Cisco software updates referenced in the advisory. Do not rely on workarounds; Cisco states none exist for this flaw.
  3. Until patched, restrict network access to the web-based management interface to trusted administrators only.
  4. Review authentication and account-management logs for password resets you did not initiate, especially resets of administrative accounts.
  5. Force password resets and rotate credentials for administrative accounts on any instance that may have been exposed.
  6. Verify the running software release against the advisory’s fixed-release guidance after upgrading.

Management note

This is an unauthenticated path to full administrative takeover of a license-management platform that typically sits on the management network. Treat it as a perimeter exposure until patched: the fix is an upgrade, and the exposure window is the time the management interface stays reachable.