SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76454

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("java.exe", "tomcat.exe")
| where ProcessCommandLine contains "Smart Licensing Utility API"
| where ProcessCommandLine contains "write" or ProcessCommandLine contains "file"
| where FolderPath contains "Cisco License On-Prem" or FolderPath contains "SSM On-Prem"

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) (Image="*\\java.exe" OR Image="*\\tomcat.exe") (CommandLine="*Smart Licensing Utility API*" AND (CommandLine="*write*" OR CommandLine="*file*")) (ParentImage="*Cisco License On-Prem*" OR ParentImage="*SSM On-Prem*")

Sigma

title: Cisco Smart Licensing Utility API File Write
status: experimental
description: Detects potential exploitation of CVE-2026-76454 in Cisco Smart Licensing Utility API.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\java.exe'
      - '\tomcat.exe'
    CommandLine|contains:
      - 'Smart Licensing Utility API'
      - 'write'
      - 'file'
    ParentImage|contains:
      - 'Cisco License On-Prem'
      - 'SSM On-Prem'
  condition: selection

Elastic ES|QL

from process where process.executable in ("java.exe", "tomcat.exe") and process.command_line : "*Smart Licensing Utility API*" and (process.command_line : "*write*" or process.command_line : "*file*") and (process.parent.executable : "*Cisco License On-Prem*" or process.parent.executable : "*SSM On-Prem*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen