Cisco License (Smart Software Manager) On-Prem Vulnerabilities

Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service (DoS) condition, or elevate privileges.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

For further documentation of improvements and fixes in Cisco License On-Prem, see Cisco License (Smart Software Manager) On-Prem Security Hardening Release ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"].

CVE-2026-20328 — Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability (CVSS 3.1 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) CVE-2026-76437 — Cisco Smart Software Manager On-Prem Command Injection Vulnerability (CVSS 3.1 4.9, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) CVE-2026-76452 — Cisco Smart Software Manager On-Prem SQL Injection Vulnerability (CVSS 3.1 4.9, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) CVE-2026-76454 — Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability (CVSS 3.1 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)