Description
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.

This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.
Published: 2026-10-07
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access through Password Reset
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated, remote attacker to reset the password of any account on the Cisco License On-Prem web interface, including high‑privileged administrative accounts, by sending a crafted request during the password reset process. This flaw is identified as improper authorization (CWE-862) and carries a CVSS base score of 9.1, reflecting the potential for complete takeover of user credentials.

Affected Systems

Affected product: Cisco License On-Prem (formerly Cisco Smart Software Manager On‑Prem). No specific affected version was listed in the advisory, so organizations should verify whether deployed instances are vulnerable until an official patch release is available.

Risk and Exploitability

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog; however, the high CVSS score indicates significant impact. The likely attack vector is the web‑based management interface over the network, and the attacker does not need prior authentication. Successful exploitation would grant the attacker full access to any user account, effectively compromising the entire application.

Generated by OpenCVE AI on October 7, 2026 at 18:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch for Cisco License On‑Prem that corrects the password reset authorization check.
  • If an immediate patch is unavailable, further restrict access to the web interface by limiting it to trusted IP ranges or disabling the password reset functionality entirely.
  • Enforce multi‑factor authentication and enforce strict access controls for all administrative accounts to reduce the impact of any credential compromise.

Generated by OpenCVE AI on October 7, 2026 at 18:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco cisco License On-prem
Vendors & Products Cisco
Cisco cisco License On-prem

Thu, 08 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.
Title Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Cisco Cisco License On-prem
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-08T13:04:30.713Z

Reserved: 2025-10-08T11:59:15.412Z

Link: CVE-2026-20328

cve-icon Vulnrichment

Updated: 2026-10-07T16:55:59.790Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T17:16:55.157

Modified: 2026-10-08T20:08:45.857

Link: CVE-2026-20328

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:15:36Z

Weaknesses