This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device.
A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Cisco UCS Central Software is a centralized management solution that allows organizations to monitor, automate, and control multiple Cisco Unified Computing System (UCS) domains and thousands of servers across global data centers and remote sites from a single interface.
Furthermore, Cisco released software updates that address this vulnerability, according to an advisory. There are no workarounds that address this vulnerability.
CVE-2026-76506 is the case number for the vulnerability, which has a CVSS base score of 7.6.
This vulnerability affects Cisco UCS Central Software, regardless of device configuration.
Users can upgrade to an appropriate fixed software release:
- 2.0 and earlier, migrate to fixed release
- 2.1, update to 2.1(2c)
Cisco PSIRT is not aware of any malicious use of the vulnerability.
Click here for additional information on other Cisco security updates.