Cisco’s Unauthenticated Password Reset
Vulnerable License On-Prem installations allow unauthenticated password reset, according to Cisco’s 7 October advisory. The operational priority is to identify the appliance, restrict unnecessary management access and choose a release that addresses the complete security picture.
Which product needs attention?
The release notes identify Cisco License On-Prem as the redesigned Smart Software Manager On-Prem, or SSM On-Prem. It manages products and licences locally rather than requiring licensed devices to connect directly to Cisco License Central. Smart Licensing Utility is unaffected.
An inventory entry that says only “Smart Licensing” is too vague. Confirm the product name on the appliance, record the installed release and assign an owner before choosing a remediation path. A familiar vendor name is not enough to determine exposure.
Access prerequisites
These are independent vulnerabilities.
- CVE-2026-20328 allows remote password reset without authentication, including administrators.
- CVE-2026-76454 permits unauthenticated API file writes or denial of service.
- CVE-2026-76437 requires administrator credentials for root commands; the additional privilege is shutdown.
- CVE-2026-76452 requires administrator credentials to read otherwise restricted database contents.
An incident record should say what was observed, rather than promoting a potential consequence into a finding.
Choosing the release
Release 10-202608 fixes these four issues; 9-202601 and earlier require migration. Cisco lists 10-202609 as unaffected.
However, a separate October security-hardening advisory still affects 10-202608 and earlier and identifies 10-202609 as the fix. It covers authentication, signature verification, credential protection and code-injection weaknesses identified in internal testing. Cisco reported no known exploitation of those internally discovered issues.
Check both advisories when choosing the release. Fixing one issue is not blanket clearance.
Plan the migration, not just the patch
The release notes list a direct upgrade to 10-202609 from 10-202608, not from every older build. They advise contacting Cisco TAC when the current release is absent from the supported path. Before upgrading a virtual-machine deployment, Cisco recommends a database backup. After a problematic move from version 9 to 10-202606 or later, it warns against reverting a version-9 snapshot and instead directs customers to TAC for supported recovery.
This makes the maintenance plan part of the security decision. Record the starting build, supported intermediate steps, backup evidence and recovery contact before the change. A download alone does not establish a safe migration path.
What defenders should verify
Before maintenance, agree who will examine account and system records, how far back they will look and what would trigger incident escalation. Preserve relevant evidence before making changes. Reducing unnecessary management reachability can help contain exposure while the change is prepared, but is not a substitute for fixing the software.
After maintenance, record the installed release and test essential licensing workflows. Have the service owner confirm the outcome instead of relying solely on a completed ticket. Where account activity or other evidence warrants it, handle credential changes through the organisation’s normal incident process. These are suggested response steps, not findings that an installation was compromised.
Cisco listed no workaround and, at publication, no known malicious use or public announcements.
The operational checks above are BlackTree recommendations, not completed tests or evidence of an incident. Updated on 8 October 2026 with fuller product, vulnerability and upgrade guidance. Reviewed on 14 October; the original report date is unchanged.
Our Cisco SD-WAN admin-access analysis covers a different product and advisory. The shared lesson is methodological: match product, release and access prerequisites before deciding what a patch closes.
