External risk intelligence

Cisco License On-Prem Password Reset Vulnerability Allows Unauthorized Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-20328

The vulnerability exists in the web-based management interface of Cisco License On-Prem. Such management interfaces for centralized license and software management applications are commonly deployed in environments where they are accessible via the network to facilitate administrative tasks and connectivity, often leading to their exposure in professional or enterprise network environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Cisco License On-Prem's web management could let an attacker reset any user's password, potentially granting them unauthorized administrative access. This is due to flaws in the password reset process and impacts systems managing software licenses.

Attackers could reset any password, gaining access.
This impacts critical license management systems.
Confirm if Cisco License On-Prem is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit a vulnerability in Cisco License On-Prem's password reset process. By sending a crafted request to the web interface, an attacker could reset the password for any account, potentially gaining administrative access and control over the application.

Requires network access.
Triggers via malicious request.
Risk of unauthorized administrative access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated, remote attacker could exploit this vulnerability by sending a malicious request to the web-based management interface of Cisco License On-Prem. This could allow the attacker to reset the password for any user account, including administrative ones, potentially granting them unauthorized access to the application with elevated privileges.

Administrative access to the application.
Malicious request to password reset.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) web management interface is a likely target for unauthenticated remote attackers due to a password reset vulnerability. Infrastructure or platform teams managing this centralized licensing system should prioritize identifying all instances, assessing their network exposure, and confirming their business criticality to determine the appropriate response and engage accountable owners for remediation planning.

Infrastructure or Platform Teams own the issue.
Verify network exposure and business criticality.
Plan remediation based on accountable owner risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco License On-Prem?

Cisco License On-Prem, formerly known as Cisco Smart Software Manager On-Prem, is an application used by organizations to manage their Cisco software licenses and entitlements locally. It acts as a centralized server that tracks and handles licensing requirements for various Cisco products within a private network, providing an interface for administrators to oversee software usage and compliance without relying on direct internet-based communication for every license transaction.

What does CWE-862 mean for CVE-2026-20328?

CWE-862 refers to Missing Authorization. In the context of this CVE, it means the application fails to verify if a user has the proper permission to perform a password reset. Because the system does not enforce a proper check during this sensitive process, an attacker can bypass security controls to reset passwords for any account, including those with full administrative authority, without needing prior access or login credentials.

How is the password reset vulnerability triggered?

The vulnerability is triggered by an attacker sending a specific, crafted request to the web-based management interface of the application. The system processes this malicious input during the password reset workflow without correctly validating the requester's authority. This issue does not stem from normal administrative actions; it specifically requires the application to be reachable and susceptible to receiving this unauthorized request.

Who should be concerned about this CVE?

Organizations running Cisco License On-Prem should pay close attention, especially if their management interface is reachable over a network. According to Halo Surface Signal, these interfaces are often deployed to facilitate administrative tasks, which can result in broader network visibility. Even if an instance is not directly on the public internet, internal network access may still be sufficient for an attacker to reach the vulnerable interface.

How do I respond if I use this software?

If you manage this application, start by identifying every instance of Cisco License On-Prem within your environment. Verify where each instance is located on your network and evaluate its importance to your operations. Once you have confirmed which systems are active, coordinate with the infrastructure or platform team responsible for that server to assess the specific risk and plan for the necessary updates or security changes provided by the vendor.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.