Act nowDisclosed

Advisory · CVE-2026-76480

Cisco License On-Prem hardening release fixes missing-authentication flaws up to CVSS 9.8

Cisco's October 2026 hardening release for Cisco License On-Prem addresses internally found missing-authentication vulnerabilities grouped under CVE-2026-76480, rated 9.8.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco License On-Prem
Identifier / CWE
CVE-2026-76480
CWE-306
Action timing
Immediate
ELI5

Explain it like I’m five

During a self check-up, Cisco found doors in its license manager that skip the ID check entirely. The fix is a software update; there is no other way to lock them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Internal review

    Cisco's engineering team ran a comprehensive internal security review of Cisco License On-Prem and found multiple improper-authentication issues.

  2. 02CVE grouping

    The issues are grouped by weakness class under CVE-2026-76480 (CWE-306: missing authentication for critical function), carrying a maximum CVSS of 9.8.

  3. 03Unauthenticated access

    Affected releases expose critical functions without requiring authentication, regardless of software configuration.

  4. 04Hardened release

    Cisco released hardened software that addresses the vulnerabilities; there are no workarounds.

What happened

On October 7, 2026, Cisco published a security hardening release for Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem). The release addresses multiple internally discovered vulnerabilities, grouped by weakness class with one CVE per class. CVE-2026-76480 covers missing-authentication-for-critical-function issues (CWE-306) with a maximum CVSS base score of 9.8. The vulnerabilities affect Cisco License On-Prem regardless of software configuration.

Cisco states the flaws were found during internal testing, are not known to be actively exploited, and that hardened software releases address them. There are no workarounds. Per the advisory, releases 10-202608 and earlier should upgrade to the first fixed release 10-202609, and releases 9-202601 and earlier should migrate to a fixed release. Cisco Smart Licensing Utility is confirmed not vulnerable.

What to do

  1. Confirm whether you run Cisco License On-Prem (any release up to and including 10-202608, or 9-202601 and earlier).
  2. Upgrade to 10-202609 or migrate to a fixed release per the advisory’s fixed-release table. There are no workarounds.
  3. Until upgraded, limit who can reach the appliance on the network; missing-authentication flaws mean network reachability equals exposure.
  4. Verify the running release after upgrading.

Management note

Hardening bundles like this one fix flaws Cisco found itself, before any public exploitation. The good news is there is no known in-the-wild use; the bad news is a 9.8 missing-authentication class needs no attacker sophistication. Prioritize the upgrade in the normal patch window and keep the appliance off broad network reach in the meantime.