# Cisco UCS Central Software: authenticated remote code execution via web management interface (CVE-2026-76506) · pwn.watch

> Cisco published a high-severity advisory for UCS Central Software, its management platform for multiple Cisco Unified Computing System domains. CVE-2026-76506 (CVSS 7.6, CWE-22 path traversal) is insufficient validation of user-supplied input in an HTTP request to the web-based management interface. An authenticated remote attacker with valid user credentials can send a crafted request to execute arbitrary commands, write arbitrary files to the filesystem and obtain sensitive information. It affects UCS Central regardless of configuration, and there are no workarounds: upgrade release 2.1 to 2.1(2c), and migrate release 2.0 and earlier to a fixed release. Cisco PSIRT says it is not aware of public announcements or malicious use.

Page: https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506 · generated 2026-11-04T19:41:22.834Z

## Status
- Severity: high · status: live · patch: patched
- Product: Cisco UCS Central Software before 2.1(2c)
- Started: 2026-11-04
- CVEs: CVE-2026-76506
- Affected: UCS Central Software 2.0 and earlier; UCS Central Software 2.1 before 2.1(2c)
- Fixed in: UCS Central Software 2.1(2c)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506/feed.xml
- JSON Feed: https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506.json
- This file: https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506/llms.txt

## Updates (newest first)
- 2026-11-04: Cisco publishes advisory cisco-sa-cucs-rce-LzHSFRDQ for CVE-2026-76506 in UCS Central Software, fixed in 2.1(2c). (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ)

## Fix brief
# Security brief: Cisco UCS Central Software: authenticated remote code execution via web management interface (CVE-2026-76506)

Source: https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506 · status: live · severity: high · updated Nov 4, 2026, 17:00 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Cisco published a high-severity advisory for UCS Central Software, its management platform for multiple Cisco Unified Computing System domains. CVE-2026-76506 (CVSS 7.6, CWE-22 path traversal) is insufficient validation of user-supplied input in an HTTP request to the web-based management interface. An authenticated remote attacker with valid user credentials can send a crafted request to execute arbitrary commands, write arbitrary files to the filesystem and obtain sensitive information. It affects UCS Central regardless of configuration, and there are no workarounds: upgrade release 2.1 to 2.1(2c), and migrate release 2.0 and earlier to a fixed release. Cisco PSIRT says it is not aware of public announcements or malicious use.

Severity detail: Cisco CVSS 3.1 score 7.6; requires valid user credentials on the device, no known exploitation

- Product: Cisco UCS Central Software before 2.1(2c)
- CVE / advisory ids: CVE-2026-76506

## Affected versions
- UCS Central Software 2.0 and earlier
- UCS Central Software 2.1 before 2.1(2c)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- UCS Central Software 2.1(2c)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Nov 4, 2026: Cisco publishes advisory cisco-sa-cucs-rce-LzHSFRDQ for CVE-2026-76506 in UCS Central Software, fixed in 2.1(2c).

## Advisories
- [Cisco UCS Central Software Remote Code Execution Vulnerability (cisco-sa-cucs-rce-LzHSFRDQ)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ) (Cisco)
- [CVE-2026-76506](https://www.cve.org/CVERecord?id=CVE-2026-76506) (CVE.org)

---
Machine-readable: https://pwn.watch/i/cisco-ucs-central-authenticated-rce-cve-2026-76506.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.