Executive Summary
CVE-2026-76454 is an unauthenticated arbitrary file write and denial of service flaw in the Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem, carrying a CVSS score of 9.1. An attacker who can reach the management API over the network can write or modify system files on the host, which is a direct path to code execution or to collapsing the license service that other infrastructure depends on.
Technical Exposure Breakdown
The root cause is a combination of two defects in the management API: improper input validation and a lack of authentication. These two conditions together remove both the gate and the filter. There is no credential check to stop an attacker from reaching the vulnerable code path, and there is no sanitization to stop the request payload from being interpreted as a file path and content.
An attacker exploits this by sending a single crafted request to the affected API endpoint. No prior access, no stolen credentials, and no user interaction are required per the grounding data. The two documented outcomes are arbitrary file write and a denial of service condition. Arbitrary file write on a Linux or appliance host is rarely a terminal state for an attacker. It is a primitive. Writing to a cron location, a service configuration, a startup script, or a web application directory converts file write into persistent code execution. The denial of service outcome is simpler and arguably worse in an operational context, because licensing services are a dependency that many downstream platforms fail closed against.
We do not have confirmed affected version ranges or patch status in the grounding data, so treat every deployed instance of License On-Prem as in scope until a vendor advisory with specific fixed builds is confirmed and validated in your environment.
OT Impact and Compliance Risk
On-prem license managers are frequently deployed inside or adjacent to the OT environment specifically to avoid cloud callouts from air-gapped or restricted networks. That design decision, taken for good reasons under IEC 62443 zone and conduit principles, places this vulnerable API squarely inside segments that operators assume are protected. A license server that fails due to the DoS condition can cascade into feature degradation, management plane lockout, or enforcement actions on dependent network and security appliances. In a plant or pipeline control network, losing management access to switching, firewalls, or monitoring tooling during an incident is an operational failure even if the process controllers themselves keep running.
For NERC CIP registered entities, a host supporting licensing for BES Cyber System components is in scope for CIP-007 patch management and CIP-005 electronic access control, and an unauthenticated API reachable across an Electronic Security Perimeter is an auditable finding. Pipeline operators under TSA SD-02C must account for this in their network segmentation and access control measures, since an unauthenticated remote write is exactly the lateral movement enabler those directives target. Water and wastewater utilities aligning to AWIA 2018 risk assessments should treat any license infrastructure touching OT as a documented dependency.
Compensating Controls
Do not rely on a patch alone, and do not run an active vulnerability scan against production OT segments to find these hosts. Active scanning of industrial networks can brick fragile components and disrupt the very license services under discussion. Use passive asset inventory and configuration review to locate License On-Prem instances instead.
- Restrict reachability to the management API to a dedicated management VLAN or jump host. The API should never be reachable from the general OT LAN or any IT to OT conduit.
- Place the host behind a firewall or IPS that terminates and inspects the API traffic. A virtual patch applied at the conduit boundary buys time while you validate a vendor fix.
- Consider a Suricata rule concept that alerts on unauthenticated POST or PUT requests to the licensing API paths from sources outside the management segment, and on request bodies containing path traversal sequences or absolute filesystem paths. Alert first in OT, then move to block once false positive rates are understood.
- Monitor the host filesystem and service configuration for unexpected writes, and baseline cron, startup, and web directories.
- Confirm the fixed build with the vendor and stage it in a maintenance window, not live.
BreachSpider Intel
BreachSpider tracks exploitation signals and advisory revisions for CVE-2026-76454 across industrial deployments so your team can monitor exposure without touching production assets.