Cisco Unified Computing System Central Software up to 2.1(2b) Web-based Management Interface information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco Unified Computing System Central Software. This issue affects some unknown processing of the component Web-based Management Interface. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-76506. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco Unified Computing System Central Software. Affected by this issue is an unknown functionality of the component Web-based Management Interface. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.

The advisory is available at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2026-76506 since 08/19/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/04/2026). This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• Unified Computing System Central Software

Version

• 2.0(1a)
• 2.0(1b)
• 2.0(1c)
• 2.0(1d)
• 2.0(1e)
• 2.0(1f)
• 2.0(1g)
• 2.0(1h)
• 2.0(1i)
• 2.0(1j)
• 2.0(1k)
• 2.0(1l)
• 2.0(1m)
• 2.0(1n)
• 2.0(1o)
• 2.0(1p)
• 2.0(1q)
• 2.0(1r)
• 2.0(1s)
• 2.0(1t)
• 2.0(1u)
• 2.0(1v)
• 2.0(1w)
• 2.1(1a)
• 2.1(1b)
• 2.1(1c)
• 2.1(2a)
• 2.1(2b)

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion