{"id":12428,"date":"2026-11-05T05:26:59","date_gmt":"2026-11-05T11:26:59","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-142-remote-code-execution-vulnerability-in-cisco-ucs-central\/"},"modified":"2026-11-05T05:30:59","modified_gmt":"2026-11-05T11:30:59","slug":"alert-2026-142-remote-code-execution-vulnerability-in-cisco-ucs-central","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-142-remote-code-execution-vulnerability-in-cisco-ucs-central\/","title":{"rendered":"Alert 2026-142 Remote code execution vulnerability in Cisco UCS Central"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
Cisco UCS Central Software<\/strong><\/td>2.0 and earlier<\/td>Migrate to a fixed version<\/td><\/tr>
Cisco UCS Central Software<\/strong><\/td>2.1 earlier than 2.1(2c)<\/td>2.1(2c)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Affects UCS Central regardless of its configuration.<\/p>\n\n

Description<\/h2>\n\n

A high-severity vulnerability (CVSSv3.1 7.6 – HIGH) has been published in the Cisco UCS Central Software management web interface. The vulnerability has been tagged as CVE-2026-76506 and is of the insufficient input validation \/ path traversal type (CWE-22).<\/p>\n\n

The vendor stated that a remote authenticated attacker, with valid credentials on the system, could send a crafted HTTP request to an affected endpoint and execute arbitrary commands, write arbitrary files to the file system, and obtain sensitive information. It affects UCS Central regardless of its configuration.<\/p>\n\n

As of Nov 5, 2026, the vendor is not aware of any public announcements or malicious use of this vulnerability. It is not listed in catalogs of known exploited vulnerabilities, does not yet have an EPSS score, and no public proofs of concept have been identified. No workarounds exist.<\/p>\n\n

Mitigation<\/h2>\n\n

The vendor stated that there are no workarounds and that the solution is to update. In the meantime, the following is recommended:<\/p>\n\n