Cisco has disclosed CVE-2026-76480, a critical missing-authentication issue (CWE-306) in Cisco License On-Prem that was found during an internal security review and fixed in software hardening releases.
What Is It
CVE-2026-76480 tracks multiple vulnerabilities in Cisco License On-Prem, which was formerly called Cisco Smart Software Manager On-Prem (SSM On-Prem). Cisco's engineering team found them during a comprehensive internal security review. Cisco groups them under CWE-306, Missing Authentication for Critical Function, and describes them as improper authentication issues.
Cisco PSIRT submitted the CVE, and NVD published it on 2026-10-07. Its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Cisco PSIRT scores this CVE at 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- An attacker can reach it over the network.
- The attack is low complexity.
- The attacker needs no privileges and no user interaction.
- A successful attack has high impact on confidentiality, integrity and availability.
CISA's SSVC assessment rates the flaw as automatable with a total technical impact. The same assessment records exploitation as none. CVE-2026-76480 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation as of publication.
License servers are often central to an organization's Cisco estate. An unauthenticated critical flaw in one should get priority even before anyone sees it exploited.
What's Vulnerable
The NVD record lists Cisco License On-Prem as affected in these versions:
- 1.x: 1.1, 1.2, 1.3, 1.4
- 6.x: 6.3.0
- 7.x: 7-202001
- 8.x: 8-202004, 8-202006, 8-202008, 8-202010, 8-202012, 8-202102, 8-202105, 8-202108, 8-202112, 8-202201, 8-202206, 8-202212, 8-202302, 8-202303, 8-202304, 8-202308, 8-202401, 8-202404
- 9.x: 9-202201, 9-202406, 9-202407, 9-202410, 9-202412, 9-202501, 9-202502, 9-202504, 9-202507, 9-202510, 9-202601
- 10.x: 10-202606, 10-202608
The record does not include any affected CPEs.
Patch Status
Cisco says it has released software hardening updates that address these vulnerabilities. The NVD record does not name the fixed versions. Administrators should check the Cisco Security Advisory below for the fixed releases and upgrade guidance, and should treat any deployment on the versions above as affected until they upgrade.
Because the CVE is not in the KEV catalog, CISA has set no required action or due date for it.