Cisco Patches a Dozen Critical Vulnerabilities

CVE-2026-76480 covers improper authentication issues (CWE-306, missing authentication for a critical function) in Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem). Cisco found the issues in an internal security review and is addressing them in software hardening releases. The CVSS 3.1 score of 9.8 indicates a remotely reachable flaw that needs no privileges and no user interaction and can fully compromise confidentiality, integrity, and availability of the affected system. Organizations running Cisco License On-Prem or SSM On-Prem are affected; exact version ranges are not stated in the provided data. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Install Cisco's software hardening releases for Cisco License On-Prem (formerly SSM On-Prem) as published by Cisco PSIRT, and confirm the exact fixed versions in that advisory because they are not listed in this dataset. Until the update is applied, do not expose the product to untrusted networks and restrict access to trusted management hosts only.

Cisco Finesse has an unauthenticated server-side request forgery flaw in its web-based management interface, tracked as CVE-2026-20362 (CWE-918). The issue is improper validation of specific HTTP requests, so a remote attacker can send a crafted request to an affected device without credentials or user interaction. A successful exploit can obtain limited sensitive information about services associated with that device and can also affect integrity in a limited way (CVSS 3.1 base score 7.2, scope changed); availability is not impacted. Organizations running Cisco Finesse as part of contact-center deployments are affected; the advisory data does not name fixed or vulnerable version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat the Finesse web management interface as untrusted-network reachable until patched: restrict it to management networks, block it from the internet, and apply the Cisco fix for CVE-2026-20362 as soon as the vendor advisory lists fixed releases. Review access logs for unexpected HTTP requests from the interface toward internal services, and do not rely on a public exploit existing before you harden exposure.

CVE-2026-76455 tracks improper access control issues (CWE-284) in Cisco NX-OS that Cisco found in an internal security review and addressed in a software hardening release. Cisco's published scoring is CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which indicates a network-reachable flaw with low complexity, no privileges, and no user interaction, and high impact to confidentiality, integrity, and availability. The provided data does not describe a specific trigger or name affected NX-OS versions or Nexus platforms. Operators of Cisco NX-OS are the population in scope until Cisco's advisory narrows the releases. There is no known public proof of concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Install the Cisco NX-OS software hardening release identified in Cisco's PSIRT advisory for CVE-2026-76455, and confirm the fixed image for each Nexus platform before upgrading. Until that release is applied, limit NX-OS management access to trusted networks and review access-control configuration for unexpected changes. No public exploit is known, but the published CVSS vector treats the issue as remotely reachable without authentication.

CVE-2026-76464 tracks multiple buffer-management flaws in Cisco networking software, grouped under CWE-119 (improper restriction of operations within the bounds of a memory buffer). Cisco found the issues in an internal security review and fixed them in a software hardening release; the public write-up does not describe a specific trigger. Per CVSS 3.1 (9.6), an adjacent-network attacker can exploit them with low complexity, no privileges, and no user interaction, with changed scope and high impact to confidentiality, integrity, and availability. The advisory text does not name individual product lines or version ranges, so the exact installed base cannot be determined from this data. No public proof of concept is known and the CVE is not in CISA KEV.

Do: Install the Cisco software hardening release that addresses CVE-2026-76464 on the networking products you run, using the official PSIRT advisory to identify the exact images. Prioritize devices reachable from adjacent networks, because the issue needs no privileges or user interaction. Until the update is applied, restrict adjacent-network access to those systems.

CVE-2026-76482 covers internally discovered improper input-verification flaws in Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), grouped under CWE-347. Cisco says the issues were found in an internal security review and addressed in software-hardening releases; the description does not specify the exact input or request that triggers them. The CVSS 3.1 score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a low-complexity, unauthenticated network attack with high impact to confidentiality, integrity, and availability and a scope change. Affected version ranges are not stated in the provided data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Install the Cisco software-hardening release for License On-Prem (formerly SSM On-Prem) identified in the Cisco PSIRT advisory for CVE-2026-76482; exact fixed versions are not in this dataset. Until patched, restrict network access to the on-prem license server to trusted management networks and review logs for unexpected unauthenticated requests.

CVE-2026-76498 covers improper access control flaws (CWE-284) in Cisco Application Policy Infrastructure Controller (APIC), found by Cisco during an internal security review and fixed in software hardening releases. The CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a remotely reachable issue that needs no privileges and no user interaction and can fully compromise confidentiality, integrity, and availability. The published description does not give a precise trigger or the affected version ranges. Operators of Cisco APIC in ACI fabrics are the affected population. It is not listed in CISA KEV, and no public proof-of-concept is known, so exploitation is none known.

Do: Apply the Cisco APIC software hardening releases that address CVE-2026-76498 as soon as they are available for your deployment, and confirm the installed build against Cisco’s PSIRT advisory. Until patched, keep the APIC management plane off the internet, restrict access to trusted admin networks, and review authentication and access-control logs for unexpected unauthenticated activity. No public exploit is known, but the critical unauthenticated rating means exposed controllers should be treated as urgent.