Cisco UCS Central Software Remote Code Execution Vulnerability

Description

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ Security Impact Rating: High CVE: CVE-2026-76506

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Cisco UCS Central Software

CVE

CVE-2026-76506

Affected versions

Cisco Unified Computing System Central Software 2.0: 23 versions, from 2.0(1e) to 2.0(1w)
Cisco Unified Computing System Central Software 2.1: 5 versions, from 2.1(1a) to 2.1(2b) (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

not yet available

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

November 4, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.