Advisory · CVE-2026-76454
Unauthenticated API flaw in Cisco License On-Prem allows arbitrary file writes
The Cisco Smart Licensing Utility API of Cisco License On-Prem lacks authentication and input validation, letting remote attackers write arbitrary files or cause denial of service.
- Vendor
- Cisco
- Product
- Cisco License On-Prem
- Identifier / CWE
- CVE-2026-76454
CWE-23 - Action timing
- Immediate
Explain it like I’m five
One of the app's back doors has no lock and accepts any package. Attackers can slip in files that overwrite important system files or knock the whole thing over.
- 01Crafted request
An unauthenticated, remote attacker sends a crafted request to the Cisco Smart Licensing Utility API on a Cisco License On-Prem instance.
- 02No authentication checked
The management API does not require authentication for the request, and input validation is improper.
- 03File write or crash
The attacker writes arbitrary files to the system, potentially modifying system files, or triggers a denial-of-service condition.
What happened
Cisco disclosed CVE-2026-76454 on October 7, 2026, rating it Critical with a CVSS base score of 9.1. The flaw is in the Cisco Smart Licensing Utility API of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem). Improper input validation combined with a lack of authentication in the management API allows an unauthenticated, remote attacker to write arbitrary files to the system or cause a denial-of-service condition on an affected application.
Cisco states it has released software updates that address the vulnerability and that there are no workarounds. Cisco PSIRT is not aware of malicious use of the vulnerability at the time of the advisory.
What to do
- Inventory Cisco License On-Prem / SSM On-Prem deployments; the advisory notes a release affected by one vulnerability in the bundle is not necessarily affected by the others.
- Apply the Cisco software updates referenced in the advisory. There are no workarounds for this flaw.
- Until patched, restrict network access to the management API to trusted hosts only.
- Check for unexpected or recently modified files on the appliance and review availability monitoring for unexplained outages.
- Verify the running software release against the advisory’s fixed-release guidance after upgrading.
Management note
An unauthenticated file-write primitive on a license-management appliance is one step from full compromise. The exposure is network-reachable by design in many deployments, so patching cadence here matters more than compensating controls, which Cisco does not offer for this flaw.