CVE-2026-76484

Executive Summary

CVE-2026-76484 is a code injection vulnerability class (CWE-94) affecting Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), disclosed as part of a broader Cisco internal security review that yielded software hardening releases. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), reflecting network-reachable attack surface, low attack complexity, and full compromise of confidentiality, integrity, and availability, with the notable caveat that exploitation requires low-level authenticated privileges (PR:L). Organizations running on-premises Cisco licensing infrastructure should treat this as an urgent remediation priority because the affected component is a central trust and entitlement authority for downstream Cisco product licensing.

Technical Analysis

CVE-2026-76484 is classified under CWE-94, "Improper Control of Generation of Code ('Code Injection')." The NVD description states that the tracked vulnerabilities "are related to issues with insufficient protection against code injection." CWE-94 is a pillar weakness that encompasses several distinct sub-classes, including injection into interpreted language contexts, dynamic code evaluation, and template/expression injection. The provided data does not specify which sub-class applies to this CVE and does not identify the affected endpoint, input parameter, file path, or function.

What can be stated with confidence from the supplied data:

• Weakness pillar: CWE-94, indicating that attacker-supplied data reaches a code generation or code evaluation sink without adequate neutralization.
• Attack surface: Network-reachable (AV:N). Cisco License On-Prem / SSM On-Prem is a server-side, on-premises application that manages license entitlements and device registration, so its externally exposed interfaces—typically administrative and API surfaces—represent the relevant attack surface.
• Privilege requirement: PR:L indicates the attacker must already hold some valid low-privileged account or session on the target system. This distinguishes the vulnerability from an unauthenticated remote code execution flaw: it is an authenticated code injection, likely exploitable by a user with limited legitimate access who can escalate that access into arbitrary code execution.
• User interaction: UI:N, so no victim user action is required once the attacker has the prerequisite access.
• Scope: S:U, meaning exploitation affects only the vulnerable component's security authority rather than crossing into other trust boundaries defined by the vulnerable system.
• Impact: C:H/I:H/A:H indicates total loss of confidentiality, integrity, and availability of the affected component.

Because the NVD description is deliberately non-specific—it is a roll-up advisory covering "multiple internally discovered vulnerabilities"—no specific parameter name, endpoint, or code path should be assumed. Security teams should treat the affected interface as any component of the License On-Prem application that accepts input and passes it toward code execution or evaluation, and should prioritize vendor-published hardening releases over speculative testing.

The absence of a CNA title, affected version list, OSV package mapping, and vendor fix reference means that precise fingerprinting of vulnerable builds is not currently possible from open-source intelligence alone. Defenders must correlate against Cisco's own security advisory and release notes for the affected product line.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-76484 as of this report. The following chain is therefore inferred strictly from the CWE-94 weakness class and the supplied CVSS metrics; no specific function names, endpoints, or parameter names are asserted because none are present in the source data.

1. Reconnaissance / target identification. An adversary identifies internet- or intranet-reachable Cisco License On-Prem / SSM On-Prem deployments. These are licensing and entitlement management servers, frequently reachable from the corporate network for device registration and license fulfillment. Fingerprinting would rely on product-specific HTTP titles, banners, or known application paths rather than on any CVE-specific signature.

2. Credential acquisition and access. Because the CVSS vector specifies PR:L, the attacker must first obtain a low-privileged account on the target—through credential stuffing, reuse of leaked credentials, a separate initial-access vector, or abuse of an over-permissioned service account. This step is a prerequisite, not part of the code injection itself.

3. Triggering the code injection (vulnerability-class level). With authenticated access, the attacker submits crafted input through any application interface that processes user-controlled data and subsequently uses that data in a code-generation or code-evaluation context without sufficient neutralization. At the class level, the injected content is interpreted as executable code rather than as inert data. The precise injection channel is not disclosed in the available data, and any assertion of a specific parameter or method would be fabrication. Because AC:L and UI:N apply, the crafted input is expected to succeed reliably and without requiring another user's interaction.

4. Execution and post-exploitation impact. Successful injection yields code execution in the context of the vulnerable application, consistent with the C:H/I:H/A:H subscores. Given that the product is a licensing and entitlement authority, post-exploitation impact plausibly includes manipulation of license state and entitlement data, access to credentials or configuration secrets held by the licensing server, and disruption of licensing services to downstream Cisco products. The S:U scope metric limits the formally assessed impact to the vulnerable component's own authority, though operators should treat a licensing server compromise as high-consequence due to its trust relationships.

Practitioners should note that this is an authenticated code injection: detection and prevention strategies must combine input-validation hardening with strong monitoring of privileged and semi-privileged activity on the licensing server, since perimeter controls alone will not stop an actor who already holds valid credentials.

Impact Assessment

The CVSS v3.1 base score of 8.8 reflects a High-severity vulnerability with the following subscores and their operational meaning:

• AV:N (Network) — Exploitation is possible over the network; the attacker does not require local or adjacent access. This expands the population of potential attackers to anyone who can route to the licensing server, subject to the privilege prerequisite.
• AC:L (Low) — No unusual race condition, memory-layout dependency, or complex precondition is assessed; repeatable exploitation is expected.
• PR:L (Low privileges) — A valid low-privileged account is required. This is the principal mitigating factor in the vector and should shape detection strategy: authentication and authorization events are as important as exploitation payloads.
• UI:N (None) — No victim interaction is needed; the attacker does not have to convince an administrator to click or approve anything.
• S:U (Unchanged) — The blast radius is formally scoped to the vulnerable component.
• C:H / I:H / A:H — Complete compromise of confidentiality, integrity, and availability of the affected component.

Business impact. Cisco License On-Prem / SSM On-Prem is a licensing and entitlement management system. A compromised licensing authority can affect downstream Cisco product operation, license compliance reporting, and entitlement issuance. Integrity loss (I:H) is particularly consequential here: manipulated license state can be difficult to detect and may persist across audits or renewals. Availability loss (A:H) can disrupt product activation and registration workflows across an estate.

Blast radius. Because affected version ranges are not disclosed, defenders cannot yet derive a precise inventory scope; all on-premises deployments of the product line should be considered candidates pending Cisco's advisory. The authenticated nature of the flaw means the effective attacker set is "holders of any account on the system," which frequently includes contractors, integrators, and service accounts in addition to internal staff.

Exploitation status. No public exploit, no PoC, no Nuclei template, and no CISA KEV listing. EPSS has not been scored by FIRST.org. The absence of public exploitation evidence does not reduce the priority of remediation: Cisco's description explicitly states these vulnerabilities were discovered during an internal review, a pattern that often precedes or accompanies eventual public technical detail.

Detection Guidance

Sigma Rule

title: Cisco License On-Prem Code Injection Attempt (CVE-2026-76484)
id: 8c1f4e2a-6b7d-4c3e-9f10-2a5d8e7c1b44
status: experimental
description: >
  Detects suspicious request patterns consistent with CWE-94 code injection
  attempts against Cisco License On-Prem (formerly SSM On-Prem). Tune to
  environment-specific endpoint names; no CVE-specific path is published.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76484
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.94
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
  selection_injection_markers:
    cs-uri-query|contains:
      - '${'
      - '#{'
      - '<%'
      - '%24%7B'
      - '${jndi'
    cs-uri-query|re: '(?i)(exec|eval|system|popen|Runtime\.getRuntime|ProcessBuilder)'
  selection_status:
    sc-status:
      - 200
      - 500
  condition: selection_method and selection_injection_markers and selection_status
falsepositives:
  - Legitimate templating features in the licensing UI
  - Security scanners and authorized penetration tests
level: high

YARA Rule

rule CVE_2026_76484_Cisco_Code_Injection_Artifacts
{
    meta:
        description = "Detects code-injection payload markers in captures or logs related to Cisco License On-Prem (CVE-2026-76484, CWE-94)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76484"
        date = "2026-01-01"
        severity = "high"

    strings:
        $inj1 = "${" ascii wide
        $inj2 = "#{" ascii wide
        $inj3 = "<%" ascii
        $inj4 = "${jndi:" nocase ascii wide
        $code1 = "Runtime.getRuntime" nocase ascii wide
        $code2 = "ProcessBuilder" nocase ascii wide
        $code3 = "eval(" nocase ascii wide
        $code4 = "system(" nocase ascii wide
        $prod1 = "Smart Software Manager On-Prem" nocase ascii wide
        $prod2 = "License On-Prem" nocase ascii wide
        $prod3 = "SSM On-Prem" nocase ascii wide

    condition:
        uint16(0) == 0x0A0D or true
        and (2 of ($inj*) or 2 of ($code*))
        and 1 of ($prod*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76484 Cisco License On-Prem Code Injection Attempt (CWE-94)"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/(?:\$\{|#\{|<%|%24%7B)/Ui"; http.request_body; pcre:"/(?i)(Runtime\.getRuntime|ProcessBuilder|eval\(|system\(|exec\()/U"; threshold:type limit, track by_src, count 5, seconds 60; classtype:web-application-attack; reference:cve,2026-76484; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76484; sid:202676484; rev:1;)

Elastic Detection

sequence by host.name, user.name with maxspan=5m
  [ authentication where event.action == "user_login" and event.outcome == "success" ]
  [ any where event.category == "web"
      and event.action == "request"
      and http.request.method in ("POST", "PUT", "PATCH")
      and (
        wildcard(http.request.body, "*${*") or
        wildcard(http.request.body, "*#{*") or
        wildcard(http.request.body, "*<%*") or
        wildcard(http.request.body, "*${jndi*") or
        wildcard(http.request.body, "*Runtime.getRuntime*") or
        wildcard(http.request.body, "*ProcessBuilder*")
      ) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=cisco:ssm:onprem
| eval method=upper(cs_method)
| where method IN ("POST","PUT","PATCH")
| eval payload=lower(coalesce(uri_query,form_data,request_body,""))
| where match(payload,"\$\{|#\{|<%|%24%7b|jndi:|runtime\.getruntime|processbuilder|eval\(|system\(")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips values(uri_path) as paths by host
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-76484,code_injection,">
  <rule id="2027648" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <match>POST|PUT|PATCH</match>
    <regex_type>pcre2</regex_type>
    <regex>(\$\{|#\{|<%|%24%7B|jndi:|Runtime\.getRuntime|ProcessBuilder|eval\(|system\()</regex>
    <description>CVE-2026-76484: Possible CWE-94 code injection attempt against Cisco License On-Prem / SSM On-Prem</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_76484,web_attack,</group>
  </rule>

  <rule id="2027649" level="13">
    <if_sid>2027648</if_sid>
    <field name="id">^authentication_success$</field>
    <description>CVE-2026-76484: Code injection attempt from a recently authenticated session (PR:L precondition met)</description>
    <group>cve_2026_76484,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The Cisco description references "software hardening releases" without a version identifier, release note, or CVE-specific fix reference, and no affected version list was supplied.

1. Immediate mitigations.

   • Restrict network reachability to the Cisco License On-Prem / SSM On-Prem management interface. Place it behind management VLANs, VPN-only access, or a strict allowlist of administrative source addresses. This directly counters the AV:N metric.
   • Enforce least privilege and strict account lifecycle management on the licensing server to reduce the population of actors who satisfy the PR:L precondition. Audit for stale, shared, and service accounts.
   • Enable and forward web server logs, authentication logs, and application logs to the SIEM before attempting remediation, so that pre-remediation exploitation attempts are detectable.
   • Consider temporary WAF or reverse-proxy input filtering for code-injection metacharacters on the licensing application's request surface, accepting that signature-based filtering is a compensating control, not a fix.
   • Maintain offline, integrity-protected backups of licensing and entitlement state to support recovery from the A:H and I:H impact profile.

2. Patch/upgrade steps.

   • Monitor Cisco's security advisories portal for the authoritative advisory covering CVE-2026-76484 and apply the identified hardening release as soon as it is published. Because no version range is available, inventory all on-premises deployments of the product line and treat them as affected until Cisco confirms otherwise.
   • Validate the fix by confirming the exact build number against Cisco's release notes, not by relying on the presence of a "hardening" marketing label.
   • Re-verify that prior configuration hardening (network restrictions, account cleanup) remains in place after the upgrade.

3. Long-term hardening.

   • Establish a recurring vendor advisory review process for peripheral infrastructure such as licensing servers, which are frequently overlooked in patch cycles despite being trust anchors.
   • Apply parameterized queries, safe APIs in place of dynamic evaluation, and strict input validation at the application layer as the durable fix for CWE-94 class weaknesses; vendor-side remediation plus organizational controls is the correct long-term posture.
   • Segment licensing infrastructure from general-purpose user networks and enforce MFA for all interactive access.
   • Log and alert on post-authentication changes to license and entitlement state, since I:H impact often manifests as silent data modification rather than a crash.

References

• NVD — CVE-2026-76484: https://nvd.nist.gov/vuln/detail/CVE-2026-76484
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Cisco Security Advisories portal (authoritative vendor advisory pending): https://sec.cloudapps.cisco.com/security/center/publicationListing.x
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76484 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild exploitation campaign is known for CVE-2026-76484 at the time of writing. EPSS has not been scored by FIRST.org, and the CVE is not listed in CISA KEV.