Cisco License OnPrem: Authenticated RCE via Web UI
CVE-2026-76437 Published on October 7, 2026
Cisco Smart Software Manager On-Prem Command Injection Vulnerability
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.
This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do.
Vulnerability Analysis
CVE-2026-76437 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-76437 has been classified to as a Shell injection vulnerability or weakness.
Affected Versions
Cisco License On-Prem:- Version 7-202001 is affected.
- Version 1.1 is affected.
- Version 6.3.0 is affected.
- Version 8-202004 is affected.
- Version 8-202006 is affected.
- Version 1.2 is affected.
- Version 1.3 is affected.
- Version 8-202012 is affected.
- Version 8-202010 is affected.
- Version 8-202008 is affected.
- Version 9-202201 is affected.
- Version 8-202102 is affected.
- Version 1.4 is affected.
- Version 8-202105 is affected.
- Version 8-202108 is affected.
- Version 8-202112 is affected.
- Version 8-202201 is affected.
- Version 8-202206 is affected.
- Version 8-202212 is affected.
- Version 8-202302 is affected.
- Version 8-202303 is affected.
- Version 8-202304 is affected.
- Version 8-202308 is affected.
- Version 8-202401 is affected.
- Version 8-202404 is affected.
- Version 9-202406 is affected.
- Version 9-202407 is affected.
- Version 9-202410 is affected.
- Version 9-202412 is affected.
- Version 9-202501 is affected.
- Version 9-202502 is affected.
- Version 9-202504 is affected.
- Version 9-202507 is affected.
- Version 9-202510 is affected.
- Version 9-202601 is affected.
- Version 10-202606 is affected.