{"id":"CVE-2026-76506","kind":"vulnerability","aliases":["CVE-2026-76506"],"related":[],"title":"Cisco UCS Central: web interface flaw lets logged-in users run commands","description":"A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.\r\nCisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.","summary":"Cisco UCS Central Software's web management interface does not validate user input in HTTP requests properly. An attacker with valid credentials can send a crafted request to execute arbitrary commands, write files, or read sensitive data.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco","infrastructure","self-hosted","ucs-central","web-management"],"not_affected_if":["no-ucs-central","no-untrusted-accounts"],"how_to_check":"- Check the installed UCS Central Software version against the advisory for CVE-2026-76506 (version list not given in the sources).\n- Confirm whether the web management interface is reachable from untrusted networks.","fix":"Cisco has released software updates that address this vulnerability; the fixed versions are not listed in the sources.\n- Fixed version: unknown","status":"open","published_at":"2026-11-04T17:17:37+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","triaged_at":"2026-11-04T17:28:43+00:00","updated_at":"2026-11-04T17:28:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T17:28:43Z","model":"claude-haiku-5-5","output":{"fix":"Cisco has released software updates that address this vulnerability; the fixed versions are not listed in the sources.\n- Fixed version: unknown","reach":"network","title":"Cisco UCS Central: web interface flaw lets logged-in users run commands","impact":"high","summary":"Cisco UCS Central Software's web management interface does not validate user input in HTTP requests properly. An attacker with valid credentials can send a crafted request to execute arbitrary commands, write files, or read sensitive data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["cisco","ucs-central","self-hosted","web-management"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands and writes files on the device","analyst_note":"Find the Cisco advisory for CVE-2026-76506 to get the affected and fixed UCS Central versions.","how_to_check":"- Check the installed UCS Central Software version against the advisory for CVE-2026-76506 (version list not given in the sources).\n- Confirm whether the web management interface is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["no-ucs-central","no-untrusted-accounts"],"who_is_affected":"Teams running Cisco UCS Central Software with its web-based management interface enabled. The attacker needs valid user credentials on the device, so exposure depends on who holds accounts and whether the interface is reachable from networks with untrusted users. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4272,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76506':16A,19A 'achiev':89C 'address':180C,188C 'affect':100C,132C,136C,172C 'allow':83C,142C 'arbitrari':60B,147C,150C 'attack':49B,87C,97C,119C,144C,164C 'authent':85C 'base':74C 'central':3A,27B,33B,80C 'cisco':1A,20B,31B,78C,174C 'code':91C 'command':13A,61B,148C 'conduct':94C 'could':82C,120C,141C 'craft':56B,127C 'credenti':52B,169C 'cve':14A,17A 'data':67B 'devic':101C,137C,173C 'disclosur':96C 'due':105C 'endpoint':133C 'execut':59B,92C,146C 'exploit':121C,140C,160C 'file':63B,151C 'filesystem':154C 'flaw':6A 'host':24B 'http':45B,116C,128C 'inform':95C,158C 'infrastructur':21B 'input':43B,113C 'insuffici':107C 'interfac':5A,38B,76C 'let':7A 'log':9A 'logged-in':8A 'manag':30B,37B,75C 'must':165C 'obtain':156C 'proper':47B 'read':65B 'releas':176C 'remot':86C,90C 'request':46B,57B,117C,129C 'run':12A 'self':23B 'self-host':22B 'send':54B,125C 'sensit':66B,157C 'softwar':34B,81C,177C 'success':139C 'suppli':112C 'uc':2A,26B,32B,79C 'ucs-centr':25B 'updat':178C 'user':11A,42B,111C,168C 'user-suppli':110C 'valid':41B,51B,108C,167C 'vulner':69C,103C,123C,162C,182C,190C 'web':4A,29B,36B,73C 'web-bas':72C 'web-manag':28B 'workaround':186C 'write':62B,149C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cisco UCS Central Software with its web-based management interface enabled. The attacker needs valid user credentials on the device, so exposure depends on who holds accounts and whether the interface is reachable from networks with untrusted users. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cisco","high","infrastructure","selfhosted","ucscentral","webmanagement"],"campaign_type":null,"first_public_at":"2026-11-04T17:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76506","severity":null,"published_at":"2026-11-04T17:17:37+00:00","modified_at":"2026-11-04T17:17:37+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}