CVE-2026-76452: Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality. To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to reach the web-based management interface remotely and possess valid administrative credentials for the affected application. Unauthenticated users and non-administrative users are not described as able to exploit it.
What could an attacker gain from successful exploitation?
Successful SQL injection could allow an attacker to read additional internal database content that administrative users should not normally be able to access. The stated impact is confidentiality; no integrity or availability impact is described.
How is the vulnerability exploited?
The attacker sends a crafted request to the web-based management interface. The issue is caused by insufficient validation of user-supplied input.