Cisco patched CVE-2026-76506, a high-severity vulnerability in the web-based management interface of Cisco UCS Central Software that could let an authenticated remote attacker execute commands, write arbitrary files or disclose sensitive information.
The flaw stems from insufficient validation of user-supplied input in an HTTP request and carries a CVSS v3.1 score of 7.6. Exploitation requires valid credentials on the affected device. Cisco says UCS Central Software 2.1 is fixed in version 2.1(2c), while version 2.0 and earlier must migrate to a fixed release. The company says no workaround is available. The Cisco security advisory was published on November 4.
Cisco said its Product Security Incident Response Team is not aware of public announcements or malicious use of the vulnerability. The company credited Anand Murugan of Gulf Business Machines with reporting the issue.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Cisco UCS Central Flaw Enables Authenticated Remote Code Execution
