CVE-2026-76452: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Cisco Cisco License On-Prem

This vulnerability arises from improper neutralization of special elements in SQL commands within the web-based management interface of Cisco License On-Prem. An authenticated remote attacker with administrative privileges can exploit this by sending crafted requests to perform SQL injection attacks. This can result in unauthorized disclosure of internal database information that should not be accessible to administrative users. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with valid administrative credentials can exploit this vulnerability to read additional internal database contents beyond normal administrative access, compromising system confidentiality. There is no impact on data integrity or system availability. The vulnerability requires authenticated access, limiting exposure to trusted users with admin rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, ensure that administrative access is tightly controlled and monitored. Since this vulnerability requires valid administrative credentials, enforcing strong authentication and limiting admin user access can reduce risk.