Critical Cisco Smart Software Manager On-Prem Remote Code Execution Vulnerability

CERT-Bund published advisory WID-SEC-2026-0964 disclosing a critical remote code execution vulnerability in Cisco Smart Software Manager On-Prem. The flaw, with CVSS Base Score 9.8 and CVSS Temporal Score 8.5, allows a remote anonymous attacker to execute arbitrary code with administrator-level privileges. Affected versions are below 9-202601. This is a newly disclosed vulnerability; no prior version of this advisory existed.

Organizations using Cisco Smart Software Manager On-Prem face immediate and severe risk — a remote unauthenticated attacker can achieve full administrative control over the affected system, potentially compromising the entire licensing management infrastructure. IT security teams must prioritize patching, conduct forensic audits for potential compromise, and implement compensating controls such as network segmentation and enhanced monitoring until the patch is applied.