Cisco fixes UCS Central flaw that lets a logged-in user run commands

Cisco fixes UCS Central flaw that lets a logged-in user run commands

4 November 2026: Cisco has fixed CVE-2026-76506 in UCS Central Software, a high-severity flaw (CVSS 7.6) in the web management interface that lets an attacker with valid user credentials run arbitrary commands, write files anywhere on the file system and read sensitive data. The fix is in release 2.1(2c), there is no workaround, and Cisco's PSIRT knows of no public exploit or attack.

UCS Central is the console that manages many Cisco Unified Computing System domains from one place: server profiles, firmware policies and inventory across data centres. Code running on it sits close to every server it manages, which is why a flaw that needs a login still matters.

How the flaw works

Cisco says the interface does not properly validate user input in an HTTP request. An attacker sends a crafted request to an affected endpoint and the software acts on it. The weakness is filed as CWE-22, path traversal, under Cisco bug ID CSCwv60193. The CVSS vector scores network access, low attack complexity, low privileges and no user interaction, with a high impact on confidentiality and a low one on integrity and availability.

Any account will do. The advisory does not limit the attack to administrators, so the useful question is how many accounts can log in to UCS Central at all, including service accounts and accounts left behind by staff who have moved on.

UCS Central is affected whatever its configuration. Cisco lists no other product as vulnerable.

Which releases are fixed

• 2.1: fixed in 2.1(2c).
• 2.0 and earlier: no fix in the train; Cisco says to migrate to a fixed release.

Cisco states that workarounds and mitigations are temporary at best and that there are none for this flaw. The PSIRT validates only the releases in its table, so a site on an older 2.0 build has a migration ahead of it, not a patch.

Until the upgrade is done

Two steps reduce exposure while an upgrade is planned. Restrict who can reach the management interface over the network, so that only the operations network or a jump host can connect. Then review UCS Central's local and remote accounts and remove the ones nobody uses, since every one of them is a way in for this bug.

The flaw was reported by Anand Murugan of Gulf Business Machines. Cisco listed it in its advance notice for 4 November alongside fixes for Unified Communications Manager and Identity Services Engine, which we covered in our Cisco Secure Email Gateway item. Our server management software category lists 15 products.

Sources

• Cisco PSIRT: Cisco UCS Central Software Remote Code Execution Vulnerability (cisco-sa-cucs-rce-LzHSFRDQ), version 1.0, first published 4 November 2026 16:00 GMT, 4 November 2026
• iThome: Cisco UCS Central advisory report, 5 November 2026