Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Cisco UCS Central flaw allows authenticated remote code execution

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco UCS Central before 2.1(2c) has an authenticated remote code execution and information disclosure flaw; users are urged to update.

A vulnerability in Cisco UCS Central Software lets an authenticated remote attacker execute code or disclose information. Cisco says insufficient validation of user-supplied input in HTTP requests is the cause, and valid credentials are required. Successful exploitation could allow arbitrary command execution, file writes, and access to sensitive data. The Canadian Centre for Cyber Security says versions prior to 2.1(2c) are affected and encourages users to review Cisco’s advisory and apply updates.

Key facts
  • Affects Cisco UCS Central Software prior to 2.1(2c)
  • Authenticated remote attacker with valid credentials required
  • Insufficient validation of user input in HTTP requests
  • Can enable arbitrary commands, file writes, and data access
  • Canadian Centre urges review of Cisco links and updates
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 4, 2026Cisco discloses authenticated RCE in UCS Central Software · Cisco Security Advisories
  2. Nov 4, 2026Cyber Centre flags UCS Central versions before 2.1(2c) · Canadian Centre for Cyber Security

What each outlet adds

beyond the shared facts
  • Cisco Security AdvisoriesHTTP input-validation cause, credential requirement, and impact details
  • Canadian Centre for Cyber SecurityAffected versions prior to 2.1(2c) and update advice
Vendors
Cisco
Products
UCS Central SoftwareUnified Communications ManagerUnified Communications Manager Session Management Edition

Coverage

oldest first · one row per article · UTC
  1. · 7d ago Cisco Security AdvisoriesFirst report

    Cisco UCS Central Software Faces Remote Code Execution Vulnerability

    Insufficient input validation in UCS Central Software HTTP requests allows authenticated remote code execution and information disclosure.

  2. · 7d ago Cisco Security Advisories

    Cisco Unified Communications Manager Faces Cross-Site Scripting Vulnerability

    Unvalidated input in the web interface of Cisco Unified Communications Manager and SME could allow unauthenticated remote XSS attacks via crafted links.