CVE-2026-20328: Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an existing account or user interaction?
No. The vulnerability can be exploited by an unauthenticated remote attacker sending a malicious request to the web-based management interface; no user interaction is described.
What level of access could an attacker obtain after exploitation?
An attacker may reset the password for an arbitrary account, including high-privileged administrative accounts. This could allow access to the application as any affected user.
Which deployments should be prioritized for assessment?
Deployments of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem, with the web-based management interface should be assessed. The provided information does not state whether the interface must be Internet-exposed or whether any default configuration is affected.