CVSS 3.1
7.6 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LCVE-2026-76506
High (7.6).
A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.
This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.
Severity
- CWE
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path traversal)
- Published
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-76506 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-76506?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-76506?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-76506 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| Cisco Unified Computing System Central Software | 2.0(1e) |
| Cisco Unified Computing System Central Software | 2.0(1a) |
| Cisco Unified Computing System Central Software | 2.0(1h) |
| Cisco Unified Computing System Central Software | 2.0(1g) |
| Cisco Unified Computing System Central Software | 2.0(1c) |
| Cisco Unified Computing System Central Software | 2.0(1k) |
| Cisco Unified Computing System Central Software | 2.0(1l) |
| Cisco Unified Computing System Central Software | 2.0(1f) |
| Cisco Unified Computing System Central Software | 2.0(1j) |
| Cisco Unified Computing System Central Software | 2.0(1b) |
| Cisco Unified Computing System Central Software | 2.0(1i) |
| Cisco Unified Computing System Central Software | 2.0(1d) |
| Cisco Unified Computing System Central Software | 2.0(1m) |
| Cisco Unified Computing System Central Software | 2.0(1n) |
| Cisco Unified Computing System Central Software | 2.0(1o) |
| Cisco Unified Computing System Central Software | 2.0(1p) |
| Cisco Unified Computing System Central Software | 2.0(1q) |
| Cisco Unified Computing System Central Software | 2.0(1r) |
| Cisco Unified Computing System Central Software | 2.0(1s) |
| Cisco Unified Computing System Central Software | 2.0(1t) |
| Cisco Unified Computing System Central Software | 2.0(1u) |
| Cisco Unified Computing System Central Software | 2.0(1v) |
| Cisco Unified Computing System Central Software | 2.0(1w) |
| Cisco Unified Computing System Central Software | 2.1(1a) |
| Cisco Unified Computing System Central Software | 2.1(1b) |
| Cisco Unified Computing System Central Software | 2.1(1c) |
| Cisco Unified Computing System Central Software | 2.1(2a) |
| Cisco Unified Computing System Central Software | 2.1(2b) |
Attack patterns (CAPEC)
- CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
- CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
- CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
- CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
- CAPEC-126 Path Traversal Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.