I’M UNDER A CYBER ATTACK

Alert

Logo de Cisco

Alert 2026-142 Remote code execution vulnerability in Cisco UCS Central

Affected product(s):

ProductAffected versionsFixed version
Cisco UCS Central Software2.0 and earlierMigrate to a fixed version
Cisco UCS Central Software2.1 earlier than 2.1(2c)2.1(2c)

Affects UCS Central regardless of its configuration.

Description

A high-severity vulnerability (CVSSv3.1 7.6 – HIGH) has been published in the Cisco UCS Central Software management web interface. The vulnerability has been tagged as CVE-2026-76506 and is of the insufficient input validation / path traversal type (CWE-22).

The vendor stated that a remote authenticated attacker, with valid credentials on the system, could send a crafted HTTP request to an affected endpoint and execute arbitrary commands, write arbitrary files to the file system, and obtain sensitive information. It affects UCS Central regardless of its configuration.

As of Nov 5, 2026, the vendor is not aware of any public announcements or malicious use of this vulnerability. It is not listed in catalogs of known exploited vulnerabilities, does not yet have an EPSS score, and no public proofs of concept have been identified. No workarounds exist.

Mitigation

The vendor stated that there are no workarounds and that the solution is to update. In the meantime, the following is recommended:

  • Restrict access to the management web interface to management networks or VPNs, and do not expose it to the Internet.
  • Review and prune UCS Central accounts, especially privileged and unused accounts, apply multi-factor or centralized authentication where possible, and rotate shared credentials.
  • Monitor the web interface logs for anomalous HTTP requests and unexpected files or commands.

Solution

The solution is to update Cisco UCS Central Software to version 2.1(2c). Installations running 2.0 or earlier must migrate to a fixed version.

For information on how to update, visit the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ

Additional information: