CVE-2026-76484: Improper Control of Generation of Code ('Code Injection') in Cisco Cisco License On-Prem

Cisco License On-Prem contains a vulnerability identified as CVE-2026-76484, which involves improper control of code generation leading to potential code injection attacks. This vulnerability is due to insufficient safeguards against code injection, classified under CWE-94. The issue was discovered during an internal security review by Cisco's engineering team, which led to software hardening releases addressing multiple vulnerabilities. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions include numerous specific releases identified by exact version strings. No public exploit or patch information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker with low complexity and some privileges to execute arbitrary code on affected Cisco License On-Prem systems, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The high CVSS score (8.8) reflects the critical nature of the impact. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Cisco has conducted internal security reviews and released software hardening updates addressing multiple vulnerabilities, but no explicit patch or remediation details for CVE-2026-76484 are provided in the available data. Users should monitor Cisco's official advisories for updates and apply any released patches promptly.