Cisco UCS Central Software: authenticated remote code execution via web management interface (CVE-2026-76506)

Cisco published a high-severity advisory for UCS Central Software, its management platform for multiple Cisco Unified Computing System domains. CVE-2026-76506 (CVSS 7.6, CWE-22 path traversal) is insufficient validation of user-supplied input in an HTTP request to the web-based management interface. An authenticated remote attacker with valid user credentials can send a crafted request to execute arbitrary commands, write arbitrary files to the filesystem and obtain sensitive information. It affects UCS Central regardless of configuration, and there are no workarounds: upgrade release 2.1 to 2.1(2c), and migrate release 2.0 and earlier to a fixed release. Cisco PSIRT says it is not aware of public announcements or malicious use.

Why this severity: Cisco CVSS 3.1 score 7.6; requires valid user credentials on the device, no known exploitation

Started

Nov 4, 2026

CVE

CVE-2026-76506

• Cisco
• #Ucs Central
• RCE
• #Path Traversal