CVE-2026-20328

Summary

The flaw is a password reset process vulnerability in Cisco License On-Prem, allowing unauthenticated attackers to reset arbitrary user passwords, potentially gaining unauthorized access. This matters because it can lead to unauthorized access to critical systems.

Exploitability

Exploitation is relatively easy given the unauthenticated nature, requiring only sending a malicious request to the web-based management interface.

Blast radius

If exploited, the impact could be severe, as it allows unauthorized access to the application, including high-privileged administrative accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the password reset feature until a patch is available, or upgrade to the latest version of Cisco License On-Prem.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.