Cisco Fixes Four License On-Prem Flaw Groups in 10-202609

Cisco has fixed four groups of vulnerabilities in License On-Prem, the software many teams still know as Smart Software Manager On-Prem. The October 7 security hardening advisory puts the first fixed release at 10-202609 for the 10-202608 branch and earlier. Installations at 9-202601 or earlier need to migrate to a fixed release. Cisco lists the product as affected regardless of configuration. The installed release determines which change to schedule.

One group, improper cryptographic signature verification, carries a maximum CVSS 10.0 score. Cisco discovered the issues in its own internal review, using existing testing and frontier AI models. Its PSIRT says it is unaware of malicious use.

Four classes across one product

Cisco assigned one CVE to each broad weakness class, grouping multiple internally discovered findings by CWE. The missing-authentication group, CVE-2026-76480, is rated up to 9.8. The signature-verification group, CVE-2026-76482, reaches 10.0. The insufficiently protected credentials group, CVE-2026-76483, reaches 9.1; the code-injection group, CVE-2026-76484, reaches 8.8. Each score is the maximum for an underlying finding within that CWE group.

The CVE vectors put the first three groups on a network path requiring no privileges or user interaction; the code-injection group’s vector requires low privileges. A signature-verification failure means the software may accept a cryptographic assertion it should reject. A missing-authentication finding means a critical function may be reachable without a valid sign-in. Triage by installed release and service reachability; Cisco’s disclosure supplies no request-path signature for a targeted hunt.

The fixed-release split

The upgrade decision has two branches. For 10-202608 and earlier in the 10-series, Cisco identifies 10-202609 as the first fixed release and lists 10-202609 itself as unaffected. For 9-202601 and earlier, including software formerly called SSM On-Prem, Cisco directs customers to migrate to a fixed release.

Cisco also confirms Smart Licensing Utility is unaffected. Separate it from License On-Prem in the inventory before creating tickets. The vendor states, “There are no workarounds that address these vulnerabilities.” Restrict access to the licensing deployment while scheduling the fixed release.

Verify the licensing release

Find deployments named Cisco License On-Prem and Cisco SSM On-Prem in your software inventory, record their installed release, and identify which networks can reach their management service. Put each 10-202608-or-earlier instance on the upgrade path to 10-202609 or an appropriate fixed release; plan a migration for 9-202601-or-earlier installations. Limit management reachability to the administrators and network paths that need it during the change window, then apply the fixed software.

After the change, read the installed release from the product and compare it with Cisco’s fixed-release table. The expected result is a release Cisco lists as fixed for that installation, with the old SSM On-Prem footprint accounted for. Preserve existing access evidence if you are separately investigating suspicious activity. A post-change version check tells you whether the software fix landed.