Skip to content
NewA calmer, faster ZeroHour
Vulnerability2

CVE-2026-76506

Authenticated RCE in Cisco UCS Central Software web interface

CVSS 3.1
7.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-76506 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A vulnerability in the web-based management interface of Cisco UCS Central Software allows an authenticated remote attacker with valid credentials to achieve remote code execution or information disclosure. This is due to insufficient validation of user-supplied input in an HTTP request. An attacker can send crafted requests to an affected endpoint, potentially executing arbitrary commands and writing files. Cisco UCS Central Software users are affected, and Cisco has released software updates.

What to do: Apply Cisco's released software updates; no workarounds.

ProductAffected
Cisco UCS Central Software—
Estimated exposure
nicheNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.

Weakness
CWE-22
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story