Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 2 advisories

CVE-2026-76506

Cisco UCS Central Software Remote Code Execution Vulnerability

CVE-2026-76506: Cisco UCS Central Software Remote Code Execution Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 7.6, Cisco).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Cisco publishes the next one.

See Cisco's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Cisco

CVE-2026-76506 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
7.6 (Cisco)
Vendor advisories
2 from Cisco
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-76506; bulletin-wide values are not repeated here.

Is CVE-2026-76506 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-76506 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-76506?

The tracked advisories that cover only this CVE do not list a fixed release yet. That does not mean no fix exists; check each vendor source below.

Vendor advisory comparison

Cisco

2 advisories
  • Advisory severityHigh7.6

    High [CVE-2026-76506] Cisco UCS Central Software Remote Code Execution Vulnerability

    cisco-sa-cucs-rce-LzHSFRDQSource published Source updated

    A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds…

    Affected products in this advisory
    • Unified Computing System Central Software
    Source-reported affected versions
    • Scope: This vulnerability affects Cisco UCS Central Software, regardless of device configuration.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Workarounds
    • There are no workarounds that address this vulnerability.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityUnrated

    Advisory [CVE-2026-20241 +2] Cisco Advance Notification for Publication of November 4, 2026, Security Advisories

    cisco-sa-notice-I8z3n6lKSource published Source updated

    This bulletin covers 3 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco UCS Central Software Remote Code Execution Vulnerability High 7.6 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability Medium 6.1 Cisco Identity Services Engine Authorization Bypass Vulnerability 5.3 To remediate the vulnerabilities that were disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability information for the remainder of calendar year 2026. The next planned…

    Affected products in this advisory
    No product details extracted. Check the source bulletin.
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.
    Full advisory and evidenceOpen source bulletin

More Cisco advisories

All Cisco advisories

Follow CVE-2026-76506 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

iPhone and Android apps · New on the App Store

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Download on the App StoreGet CVE alerts on AndroidSee app features