CVE-2026-76452
Received Received - Intake

SQL Injection in Cisco License On-Prem Web Interface

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality. To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-76452
EUVD
EUVD-2026-94450

Affected Vendors & Products

Showing 36 associated CPEs
Vendor Product Version / Range
Cisco Cisco License On-Prem 1.2
Cisco Cisco License On-Prem 1.3
Cisco Cisco License On-Prem 8-202012
Cisco Cisco License On-Prem 8-202010
Cisco Cisco License On-Prem 8-202008
Cisco Cisco License On-Prem 9-202201
Cisco Cisco License On-Prem 8-202102
Cisco Cisco License On-Prem 1.4
Cisco Cisco License On-Prem 8-202105
Cisco Cisco License On-Prem 8-202108
Cisco Cisco License On-Prem 8-202112
Cisco Cisco License On-Prem 8-202201
Cisco Cisco License On-Prem 8-202206
Cisco Cisco License On-Prem 8-202212
Cisco Cisco License On-Prem 8-202302
Cisco Cisco License On-Prem 8-202303
Cisco Cisco License On-Prem 8-202304
Cisco Cisco License On-Prem 8-202308
Cisco Cisco License On-Prem 8-202401
Cisco Cisco License On-Prem 8-202404
Cisco Cisco License On-Prem 9-202406
Cisco Cisco License On-Prem 9-202407
Cisco Cisco License On-Prem 9-202410
Cisco Cisco License On-Prem 9-202412
Cisco Cisco License On-Prem 9-202501
Cisco Cisco License On-Prem 9-202502
Cisco Cisco License On-Prem 9-202504
Cisco Cisco License On-Prem 9-202507
Cisco Cisco License On-Prem 9-202510
Cisco Cisco License On-Prem 9-202601
Cisco Cisco License On-Prem 10-202606
Cisco Cisco License On-Prem 7-202001
Cisco Cisco License On-Prem 1.1
Cisco Cisco License On-Prem 6.3.0
Cisco Cisco License On-Prem 8-202004
Cisco Cisco License On-Prem 8-202006

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the web-based management interface of Cisco License On-Prem. It occurs due to insufficient validation of user-supplied input, allowing authenticated remote attackers with administrative credentials to send crafted requests. A successful exploit could enable attackers to read additional contents of the internal database that should not be accessible to administrative users, impacting system confidentiality.

Impact Analysis

If you are an administrative user of Cisco License On-Prem, an attacker with valid credentials could exploit this vulnerability to access sensitive data in the internal database that is not normally available to administrators. This could lead to unauthorized data exposure, compromising confidentiality of system information.

Mitigation Strategies

Immediately update Cisco License On-Prem to the latest patched version to address the SQL injection vulnerability. Ensure all administrative user credentials are reviewed and strong passwords enforced to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart