Cisco UCS Central Software flaw CVE-2026-76506 lets an authenticated attacker run commands
A low-privileged account is enough, Cisco offers no workaround, and the oldest branch gets no fix of its own: Cisco tells those customers to migrate to a fixed release.
Affects
UCS Central Software
What to do
Upgrade UCS Central Software to 2.1(2c), migrating any 2.0 or earlier instance to a fixed release.
- Vendor advisory
- CVE
- CVE-2026-76506
- CVSS
- 7.6 (v3.1, Cisco)
- Exploitation
- None known
- Affected
- UCS Central Software 2.0 and earlier
- UCS Central Software 2.1 before 2.1(2c)
- Fixed in
- 2.1(2c)
How the flaw works
The flaw sits in the web-based management interface of Cisco UCS Central Software. Cisco attributes it to insufficient validation of user-supplied input in an HTTP request. An attacker with valid user credentials sends a crafted HTTP request and can execute arbitrary commands, write arbitrary files to the filesystem and obtain sensitive information. Cisco's scoring treats a low-privileged account as enough.
What to do now
Start with any instance on the branch Cisco gives no fixed release, because it needs a migration, then any whose management interface is reachable from staff networks or the internet.
- Find every UCS Central instance and note the release it runs
- Until upgraded, limit the management interface to an admin network or jump host
- Migrate instances on the unfixed branch to a fixed release
- Upgrade the remaining instances to the first fixed release for their branch
- Remove unused UCS Central accounts and reset passwords on the rest
Who is affected
Cisco states the flaw affects UCS Central Software regardless of device configuration. Firms whose UCS servers are run by a reseller or managed provider should ask which release is in place and when it will be upgraded.
Detection notes
To exploit the flaw, the attacker must have valid user credentials on the affected device. Management interface sign-ins and what followed them are the records to review.
- Web interface sign-ins from addresses outside the admin network
- Sign-ins by accounts that rarely or never use UCS Central
- Crafted HTTP requests to the management interface carrying ../ or encoded path characters
- Files on the UCS Central filesystem that no upgrade or administrator created
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours from release for internet-facing services when a vendor rates a flaw critical or a working exploit exists. Cisco rates this flaw high, so for an internet-facing instance the 48-hour rule applies once a working exploit exists.
Restrict administrative privileges and multi-factor authentication limit who holds a login that reaches the interface.
Sources
- PrimaryCisco, Cisco UCS Central Software Remote Code Execution Vulnerability (cisco-sa-cucs-rce-LzHSFRDQ, 4 November 2026)Retrieved 5 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
