CVE-2026-76454

Executive Summary

CVE-2026-76454 is a critical (CVSS 9.1) unauthenticated remote vulnerability in the Cisco Smart Licensing Utility API component of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem). The flaw stems from improper input validation combined with a lack of authentication in the management API, allowing an unauthenticated, remote attacker to write arbitrary files to the system or cause a denial-of-service condition on the affected application. Organizations operating on-premises Cisco licensing infrastructure should treat this as a high-priority exposure because the affected API is reachable without credentials and the impact includes both integrity compromise of system files and availability loss.

Technical Analysis

The vulnerability resides in the Smart Licensing Utility API of Cisco License On-Prem. Per the NVD description, two distinct defects combine to produce the exploitable condition:

1. Missing authentication in the management API — the affected API endpoint can be reached by an unauthenticated, remote attacker. No credentials, session tokens, or prior foothold are required (CVSS PR:N, AV:N).
2. Improper input validation — the API fails to adequately validate the data supplied by the requester, which is the root cause that permits writing arbitrary files to the system.

The CWE classification is CWE-23 (Relative Path Traversal). This indicates the validation failure manifests as a path-handling weakness: input supplied to the API is used to construct file-system locations without adequate normalization or confinement, allowing the attacker to influence which files are written and where, relative to an intended base directory. The CVSS vector records Impact on Integrity as High (I:H) and Impact on Availability as High (A:H) with no Confidentiality impact (C:N), which is consistent with a primitive that writes or overwrites files rather than one that reads or discloses them. The DoS condition referenced in the description is a consequence of the same write primitive (for example, corrupting or overwriting files required by the application) or of the request handling itself.

The attack surface is the management API of an on-premises licensing server — a system that typically sits in a management or internal-services network segment and is reachable over the network by design. Because authentication is absent on the affected endpoint, no social engineering, credential theft, or user interaction (UI:N) is required. Attack complexity is rated Low (AC:L), meaning no specialized conditions or race windows are needed once the vulnerable endpoint is identified.

Scope is rated Unchanged (S:U) — the impact is confined to the vulnerable component rather than crossing an authorization boundary into other security scopes.

Note: The available NVD description does not disclose specific parameter names, URI paths, function names, or the intended base directory involved in the path construction. Those details are intentionally not asserted here. Any statement of the form "send a POST to /api/... with parameter X" would be fabricated and is excluded.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-76454 at the time of writing. The following attack chain is inferred strictly from the vulnerability class (CWE-23 path traversal with missing authentication) and the NVD description; it does not rely on any claimed implementation detail beyond what is published.

1. Reconnaissance / target identification. An attacker scans internet-facing or reachable-internal address space for Cisco License On-Prem / Smart Software Manager On-Prem management interfaces. Identification is by HTTP response fingerprints (page title, static asset paths, TLS certificate subject referencing Cisco) rather than by any disclosed API route. Public scanning services (Shodan, Censys) can be used to enumerate candidate hosts.

2. Triggering the flaw class. The attacker sends a crafted, unauthenticated request to the Smart Licensing Utility management API. The request carries input that the API does not validate properly, and because the endpoint performs no authentication check, the request is processed. Per the CWE-23 classification, the malformed input influences the path used for a file-system operation, escaping the directory the API intends to confine writes to.

3. Payload / execution method (vulnerability-class level). The write primitive is exercised through the crafted request itself — the attacker does not need to upload a separate binary through a distinct channel. The content and destination are determined by the input the API fails to validate. Whether the written content is itself interpreted or executed depends on which files the attacker can reach, which is not disclosed publicly.

4. Post-exploitation impact. Two outcomes are documented: (a) modification of system files, an integrity compromise that can alter application behavior, configuration, or licensing state; and (b) a denial-of-service condition on the affected application. Persistence, lateral movement, or credential access are not described and should not be assumed from this CVE alone.

Validation of these steps in a lab should be performed only against systems you are authorized to test, using the vendor's own documentation to map the management API surface.

Impact Assessment

• CVSS 9.1 (Critical) — AV:N / AC:L / PR:N / UI:N / S:U / C:N / I:H / A:H.
• Confidentiality: None. The vulnerability is not described as disclosing data. Note that arbitrary file write can, in some architectures, be chained into disclosure or code execution; the CVSS vector does not score that, and no public evidence supports it here.
• Integrity: High. Unauthenticated modification of system files is a direct trust violation. For a licensing server, corrupted licensing state can cascade into service entitlement failures across the estate that depends on it.
• Availability: High. The documented DoS outcome means the licensing service can be taken offline. Because Cisco License On-Prem frequently serves as an authorization dependency for other Cisco products, availability loss may propagate beyond the single host.
• Blast radius. Any organization running Cisco License On-Prem (formerly SSM On-Prem) with the Smart Licensing Utility API reachable from an untrusted network. The absence of authentication means no privileged account is needed, so exposure is purely a function of network reachability. Internal-only deployments are still at risk from any attacker or malware already inside the perimeter.
• Exploitability. AC:L and PR:N make this trivially repeatable once the endpoint is identified. The lack of a public PoC or KEV listing lowers the observed current exploitation rate, but does not reduce the underlying severity for exposed instances.

Detection Guidance

Sigma Rule

title: Unauthenticated Smart Licensing Utility API Path Traversal File Write (CVE-2026-76454)
id: 8f4c2a91-7d3e-4b16-9c58-2a6e1f0d7b34
status: experimental
description: Detects unauthenticated requests to the Cisco License On-Prem Smart Licensing Utility API containing path traversal sequences indicative of CVE-2026-76454 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76454
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
detection:
  selection_api:
    cs-uri-stem|contains:
      - '/licensing'
      - '/smart'
      - '/api/'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
  condition: selection_api and selection_traversal
falsepositives:
  - Legitimate administrative tooling that normalizes paths client-side
  - Vulnerability scanners performing authorized assessment
level: high

YARA Rule

rule CVE_2026_76454_SmartLicensing_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting the Cisco License On-Prem Smart Licensing Utility API (CVE-2026-76454)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76454"
        severity = "critical"

    strings:
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "..%2f" ascii nocase
        $traversal4 = "..%5c" ascii nocase
        $traversal5 = "%2e%2e%2f" ascii nocase
        $api1 = "Smart Licensing" ascii nocase
        $api2 = "licensing" ascii nocase

    condition:
        uint16(0) == 0x4854 or
        (any of ($traversal*) and any of ($api*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76454 Cisco License On-Prem Smart Licensing Utility API Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/licensing"; http.uri; content:"../"; nocase; reference:cve,2026-76454; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76454; classtype:web-application-attack; sid:202676454; rev:1;)

alert http any any -> any any (msg:"CVE-2026-76454 Cisco License On-Prem Path Traversal (encoded)"; flow:established,to_server; http.uri; content:"%2e%2e%2f"; nocase; reference:cve,2026-76454; classtype:web-application-attack; sid:202676455; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.category == "network" and network.transport == "tcp" ]
  [ http where http.request.method == "POST"
      and http.request.uri : ("*licensing*" or "*smart*")
      and (http.request.uri : "*../*" or http.request.uri : "*%2e%2e*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| eval uri=coalesce(uri, url, request)
| where match(lower(uri), "(\.\./|%2e%2e%2f|\.\.%5c|%2e%2e/)")
| where match(lower(uri), "(licensing|smart|api)")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, host
| where count >= 1
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,cve_2026_76454,">
  <rule id="2026764" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <id>^POST</id>
    <url>licensing|smart</url>
    <regex>\.\./|%2e%2e%2f|\.\.%5c</regex>
    <description>CVE-2026-76454: Possible unauthenticated path traversal against Cisco License On-Prem Smart Licensing Utility API</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch version, or workaround has been published in any tracked source. As of this writing, Cisco has not released an advisory-mapped fixed release for CVE-2026-76454 in the data reviewed.

1) Immediate mitigations (compensating controls).

• Remove network reachability of the Smart Licensing Utility management API from untrusted networks. Restrict inbound access to the management interface to specific administrative source addresses using host firewalls, ACLs, or a reverse proxy that enforces authentication in front of the API.
• Do not expose Cisco License On-Prem / Smart Software Manager On-Prem management interfaces to the public internet. Verify with external attack-surface scanning that no instance is internet-facing.
• Where the API is not required for operations, disable the management API or bind it to a loopback/management-only interface.
• Enable you cannot validate input at the vendor layer — so validate it at the edge: deploy a WAF rule that rejects request URIs containing traversal sequences (../, %2e%2e%2f, ..\) to the licensing endpoints. This is a mitigation, not a fix, and must be tested against legitimate client behavior.
• Increase logging verbosity on the licensing server and forward logs to the SIEM so the detection rules above have telemetry.

2) Patch / upgrade steps.

• Monitor the Cisco Security Advisories portal for the advisory covering CVE-2026-76454 and the listed fixed release for Cisco License On-Prem. No fixed version is known at this time; do not assume an upgrade to the latest release resolves the issue without advisory confirmation.
• Until a fix is published, treat the compensating controls as the primary defense and re-check for the advisory on a regular cadence.
• Once a fixed release is available, patch out-of-band systems first (those not in the direct licensing dependency path) to validate the upgrade, then roll through the production licensing servers in a maintenance window. Snapshot or back up licensing state before upgrading.

3) Long-term hardening.

• Segment licensing and management infrastructure into a dedicated management VLAN with strict east-west controls; these systems should never be reachable from user or DMZ networks.
• Enforce authenticated reverse-proxy fronts for all management APIs regardless of vendor claims of built-in authentication, so a single missing auth check does not become an unauthenticated primitive.
• Maintain an authoritative inventory of internet-facing and management-plane appliances, and feed it into continuous external scanning so newly exposed services are caught quickly.
• Adopt a file-integrity monitoring (FIM) baseline for licensing server file systems so unauthorized writes generate alerts even if the request itself evades network detection.
• Track CISA KEV and vendor advisories; re-prioritize this CVE if it is added to KEV or if a public exploit is released.

References

1. NVD — CVE-2026-76454: https://nvd.nist.gov/vuln/detail/CVE-2026-76454
2. CWE-23 — Relative Path Traversal: https://cwe.mitre.org/data/definitions/23.html
3. Cisco Security Advisories and Notices (vendor advisory location for Cisco License On-Prem / SSM On-Prem): https://sec.cloudapps.cisco.com/security/center/publicationListing.x
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76454 is not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (no score published for this CVE at time of writing): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template exists; the CVE is not in CISA KEV; no threat actor campaign has been attributed. EPSS has not yet scored this CVE — no probability value is asserted. The absence of observed exploitation reflects the immaturity of the disclosure, not a reduced risk for exposed, unpatched instances.