CVE-2026-76177

OCS Inventory contains a server-side request forgery flaw (CWE-918) in its web console at the /ocsreports/?function=tele_activate endpoint, caused by insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can set these parameters to arbitrary values, causing the OCS Inventory server to issue HTTP/HTTPS requests to attacker-chosen destinations. This lets the attacker reach internal network services or cloud instance metadata endpoints, with a high confidentiality impact (potential exposure of internal data or cloud credentials) but no integrity or availability impact on the vulnerable system. Any OCS Inventory deployment whose console is reachable by operator-level accounts is affected; the available data does not specify affected version ranges. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.3% probability of exploitation within 30 days (27th percentile).

What to do: Until a patched release is announced (monitor the vendor/INCIBE advisory for the fixed version), restrict the /ocsreports endpoint to trusted users and audit operator accounts, since exploitation requires operator privileges. Apply egress filtering from the OCS Inventory server (e.g., block access to cloud metadata services such as link-local addresses like 169.254.169.254) and limit which hosts it can reach, and avoid exposing ocsreports to the internet where not required. Check logs for tele_activate requests carrying unexpected HTTPS_SERV or FILE_SERV values as an indicator of probing.