A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow… (CVE-2026-76437)

This vulnerability in Cisco License On-Prem's web interface is caused by improper validation of user-supplied configuration data. An attacker with valid administrative credentials can update configurations to execute arbitrary OS commands with root privileges. The vulnerability does not allow privilege escalation beyond administrative access but grants the ability to perform actions such as turning off the system, which administrators cannot normally do.

An attacker who already has administrative access can execute arbitrary commands on the underlying operating system with root privileges, potentially disrupting system availability by shutting down the system. There is no indication of confidentiality or integrity impact beyond availability, and no privilege escalation from non-administrative users.

No patch or official fix information is provided. Since exploitation requires valid administrative credentials, restricting administrative access and monitoring for unauthorized configuration changes are recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.