EN PT-BR
← Voltar ao feed
high

Cisco UCS Central CVE-2026-76506 authenticated RCE patched in 2.1(2c), disclosed alongside ISE and Unified CM flaws and the Node2Shell advisory update

4 fonte(s) · 4 atualização(ões) · publicado 04/11/2026 13:00 · coletado há 14 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 07/11/2026 00:06; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityweek.com ↗ securityonline.info ↗ sec.cloudapps.cisco.com ↗

Cisco disclosed CVE-2026-76506 on 4 November 2026. It is a High-severity flaw in the web-based management interface of Cisco UCS Central Software that lets an authenticated, remote attacker with low-privileged credentials execute arbitrary commands, write arbitrary files and obtain sensitive information (sec.cloudapps.cisco.com). Cisco released software updates and says no workarounds exist. The fix is in UCS Central 2.1(2c), and the CVSS score is reported as 7.6 (securityonline.info). Cisco is not aware of public exploitation or proof-of-concept tools for this flaw (securityonline.info). It was disclosed with two other Cisco fixes, CVE-2026-20241 in ISE/ISE-PIC and CVE-2026-76419 in Unified CM (securityonline.info). It also fell in the same week as an updated Cisco advisory on the actively exploited Brotli flaw Node2Shell (CVE-2026-111497) (securityweek.com). CERT-FR relayed the Cisco advisories on 5 November, listing a wider set of affected products with fix timelines that differ from Cisco's statement on UCS Central (cert.cyber.gouv.fr).

Entenda a falha

A vulnerabilidade

CVE-2026-76506 is a High-severity flaw in the web management interface of Cisco UCS Central Software. Cisco rates it only as High; the CVSS 7.6 figure comes from securityonline.info. An authenticated remote attacker with valid low-privileged credentials can send a crafted HTTP request to run arbitrary commands, write arbitrary files and read sensitive data. Affected: 2.0 and earlier, and 2.1 builds before 2.1(2c), which is the fixed version. No workarounds exist. Disclosed with CVE-2026-76419 (Unified CM/SME 14 and 15 before 15SU5, XSS needing user interaction, CVSS 6.1) and CVE-2026-20241 (ISE/ISE-PIC 3.1 to 3.5, unauthenticated authorization bypass to get an endpoint certificate, CVSS 5.3). Node2Shell (CVE-2026-111497, Brotli) is already exploited and is only context.

Como funciona

A logged-in user sends an HTTP request to an endpoint of the UCS Central web portal. The software takes the user-supplied input in that request and processes it without validating it enough. Because of this, the input can end up triggering command execution, file writes to the filesystem and disclosure of sensitive information. The articles do not name the endpoint or describe the internal steps in more detail.

Por que é vulnerável

For CVE-2026-76506 the root cause is insufficient validation of user-supplied input in an HTTP request. For the companion flaws, Cisco attributes CVE-2026-20241 to improper authorization checks in ISE, and CVE-2026-76419 to the Unified CM web interface not properly validating user input. The articles do not say why they went unnoticed or what the fixes change in the code.

Como foi descoberta

According to securityonline.info, Anand Murugan of Gulf Business Machines reported the UCS Central flaw, Nicholas Michael Kloster found the ISE flaw, and an external researcher reported the Unified CM one. Cisco published the UCS Central advisory (cisco-sa-cucs-rce-LzHSFRDQ) on 4 November 2026, and CERT-FR relayed it on 5 November. Cisco's PSIRT says it is not aware of public announcements or malicious use of these flaws.

Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:22.

Detalhes técnicos

  • CVE-2026-76506 stems from insufficient validation of user-supplied input in HTTP requests. A crafted request to an affected endpoint of the UCS Central web portal enables command execution, arbitrary file writes and information disclosure (sec.cloudapps.cisco.com, securityonline.info).
  • Affected versions are UCS Central 2.0 and earlier, and 2.1 builds before 2.1(2c). The flaw was reported by Anand Murugan of Gulf Business Machines (securityonline.info).
  • CVE-2026-20241 (CVSS 5.3) is an improper authorization check in Identity Services Engine (ISE/ISE-PIC) branches 3.1 to 3.5. An unauthenticated remote attacker can bypass authorization and obtain an endpoint certificate. It was found by Nicholas Michael Kloster (securityonline.info).
  • CVE-2026-76419 (CVSS 6.1) is an input-validation flaw in Unified CM / Unified CM SME versions 14 and 15 before 15SU5. It allows cross-site scripting and requires user interaction. It was reported by an external researcher (securityonline.info).
  • CVE-2026-111497 (Node2Shell / HTTP2Shell / Broccoli2Shell) is an out-of-bounds write in Google's Brotli library. Cisco has confirmed it in 19 products and nearly a dozen Splunk products, with investigation ongoing. It was already under active exploitation per prior reporting (securityweek.com).
  • CERT-FR advisory CERTFR-2026-AVI-1467 covers CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 and CVE-2026-76506. It cites the Cisco bulletins cisco-sa-oct2026-node-js-Jj3SQ19u (27 October) and cisco-sa-cucs-rce-LzHSFRDQ (4 November). It describes remote code execution, a security policy bypass and an unspecified security issue, does not map CVEs to products, and gives no CVSS scores or exploitation data (cert.cyber.gouv.fr). Products it lists include BPA, Catalyst Center, Duo Authentication Proxy Local Manager for Windows, Duo Network Gateway, Intersight, Nexus 9000 in standalone NX-OS mode (Guest Shell), Packet Tracer, Private 5G, Secure Endpoint Private Cloud Appliance, Smart PHY, Spaces, UCS Central (before 2.1(2c)), Virtualized Infrastructure Manager and Webex Connect.

Remediação

  • Upgrade UCS Central to 2.1(2c) or later. No workarounds exist, so patching is the only mitigation. Restricting network access to web administration portals is also recommended (securityonline.info).
  • Upgrade ISE/ISE-PIC to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. The last supported ISE-PIC branch is 3.4 (securityonline.info).
  • Upgrade Unified CM / Unified CM SME to 15SU5 (securityonline.info).
  • For the other products in the CERT-FR advisory, follow the Cisco bulletins. CERT-FR lists planned fixes: BPA before 5.0, Duo Authentication Proxy, Intersight, Intersight Virtual Appliance, Secure Endpoint Private Cloud Appliance and Webex Connect in November 2026; Packet Tracer in December 2026; Smart PHY in March 2027; Catalyst Center in July 2027; BPA before 4.1.2 and before 5.1 and Private 5G to be determined (cert.cyber.gouv.fr).

Relatos divergentes

  • Fix availability for UCS Central: Cisco says software updates are released (sec.cloudapps.cisco.com), and securityonline.info names 2.1(2c) as the fixed version. CERT-FR says several fixes are not yet available and gives no fix date for UCS Central (cert.cyber.gouv.fr). CERT-FR does not map CVEs to products and says only that the page gives no dates, so Cisco's vendor statement is the more authoritative source for this CVE.
  • Severity: Cisco and securityweek.com describe CVE-2026-76506 only as High. The CVSS 7.6 figure comes solely from securityonline.info. CERT-FR gives no score.
  • Exploitation: securityonline.info reports that Cisco is not aware of public exploitation of CVE-2026-76506. Neither securityweek.com nor CERT-FR reports exploitation of the newly patched issues. The exception is Node2Shell (CVE-2026-111497), which is already exploited per prior reporting (securityweek.com).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 04/11/2026 21:00 · coletado 06/11 12:00

    CERT-FR: Multiple vulnerabilities in Cisco products, including remote code execution (Cisco advisories of 27 Oct and 4 Nov 2026)

    ler a análise desta fonte

    The CERT-FR advisory CERTFR-2026-AVI-1467 (5 November 2026) relays two Cisco security advisories: cisco-sa-oct2026-node-js-Jj3SQ19u (27 October 2026) and cisco-sa-cucs-rce-LzHSFRDQ (4 November 2026). It covers five CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497 and CVE-2026-76506. CERT-FR says they allow remote arbitrary code execution, a security policy bypass and an unspecified security issue. The page gives no CVSS scores, prerequisites or exploitation in the wild. It also does not say which CVE affects which product. Several fixes are not yet available.

    Technical Details

    The advisory names the Node.js-related bulletin and a bulletin with RCE in its identifier (cucs-rce). It does not describe the bug classes, state the product of that bulletin or map CVEs to products. The affected products listed are:

    • Business Process Automation (BPA), versions before 4.1.2, before 5.0 and before 5.1
    • Catalyst Center, versions before 3.4.1
    • Duo Authentication Proxy Local Manager for Windows, versions before 6.8.1
    • Duo Network Gateway, versions before 3.4.2
    • Intersight and Intersight Virtual Appliance
    • Nexus 9000 Series Switches in standalone NX-OS mode (Guest Shell)
    • Packet Tracer, versions before 9.2.0
    • Private 5G, versions before 22.23.4
    • Secure Endpoint Private Cloud Appliance
    • Smart PHY
    • Spaces, versions before 24.22.1
    • UCS Central Software, versions before 2.1(2c)
    • Virtualized Infrastructure Manager
    • Webex Connect, versions before 6.22.2

    Remediation

    Fixes are planned for these products, according to CERT-FR:

    • BPA before 5.0: November 2026
    • Duo Authentication Proxy Local Manager for Windows before 6.8.1: November 2026
    • Intersight, Intersight Virtual Appliance, Secure Endpoint Private Cloud Appliance and Webex Connect: November 2026
    • Packet Tracer: December 2026
    • Smart PHY: March 2027
    • Catalyst Center: July 2027
    • BPA before 4.1.2 and before 5.1, and Private 5G: date to be determined
    • Duo Network Gateway, Spaces, UCS Central Software, Nexus 9000 (Guest Shell) and Virtualized Infrastructure Manager: no fix date given on the CERT-FR page

    CERT-FR refers readers to the Cisco bulletins for the fixes.

  2. securityweek.com ↗ · pub. 05/11/2026 09:33 · coletado 05/11 10:00

    Cisco, WatchGuard Patch Critical Flaws While SonicWall Leaves EOL GMS Vulnerabilities Unfixed

    ler a análise desta fonte

    Cisco and WatchGuard released a batch of patches this week addressing remote code execution, authentication bypass, and integrity-validation flaws across multiple products, while SonicWall confirmed it will not patch two vulnerabilities in its end-of-life Global Management System (GMS) platform. WatchGuard published five advisories, the most severe being CVE-2026-98432 (CVSS 9.8), a use-after-free in the Linux kernel's IPv4 code affecting Fireware OS, WatchGuard AP, and Dimension, alongside four previously disclosed critical/high AuthPoint Authentication Gateway flaws. Cisco fixed a high-severity authenticated RCE/information-disclosure bug in UCS Central Software (CVE-2026-76506) and updated its advisory on the actively exploited Brotli library flaw known as Node2Shell/HTTP2Shell/Broccoli2Shell (CVE-2026-111497), now confirmed to affect 19 Cisco products and nearly a dozen Splunk products, with investigation ongoing. SonicWall disclosed that its legacy GMS platform, which reached end-of-life in October 2025, contains an unauthenticated critical file-read vulnerability (CVE-2026-109593) and a medium-severity SQL injection flaw (CVE-2026-109594) that will remain unpatched. Neither Cisco nor WatchGuard reported active exploitation of the newly patched issues, but Node2Shell is already under active exploitation per prior reporting.

    Technical Details

    • CVE-2026-98432 (CVSS 9.8) — Use-after-free in Linux kernel IPv4 networking code; Dimension is vulnerable but no patch is yet available.
    • CVE-2026-76506 — High-severity flaw in Cisco UCS Central Software allowing authenticated attackers to execute arbitrary code or leak information.
    • CVE-2026-111497 (Node2Shell/HTTP2Shell/Broccoli2Shell) — Out-of-bounds write in Google's Brotli compression library, confirmed in 19 Cisco products and nearly a dozen Splunk products, with more under investigation.
    • CVE-2026-109593 — Critical, unauthenticated file-read vulnerability in SonicWall GMS (EOL, unpatched).
    • CVE-2026-109594 — Medium-severity SQL injection in SonicWall GMS allowing database access/modification (EOL, unpatched).

    Remediation

    Apply WatchGuard and Cisco patches immediately where available; WatchGuard Dimension users should restrict network access pending a fix. Organizations still running SonicWall GMS should migrate off the end-of-life platform since no patches will be issued for the file-read and SQL injection flaws; isolate or decommission exposed GMS instances.

  3. securityonline.info ↗ · pub. 05/11/2026 00:57 · coletado 05/11 01:00

    Cisco Patches High-Severity RCE in UCS Central Plus Cert-Theft and XSS Flaws in ISE, Unified CM

    This article confirms the previously reported CVE-2026-76506 UCS Central RCE patch details (fixed in 2.1(2c), affecting version 2.0 and earlier) and adds two new, related Cisco vulnerabilities disclosed in the same bulletin: CVE-2026-20241, an unauthenticated authorization bypass in ISE/ISE-PIC allowing certificate theft (CVSS 5.3), and CVE-2026-76419, a cross-site scripting flaw in Unified CM/Unified CM SME (CVSS 6.1). It also credits the researchers who reported the UCS Central and ISE flaws and provides specific patch version numbers for all three issues.

    ler a análise desta fonte

    This article confirms the previously reported CVE-2026-76506 UCS Central RCE patch details (fixed in 2.1(2c), affecting version 2.0 and earlier) and adds two new, related Cisco vulnerabilities disclosed in the same bulletin: CVE-2026-20241, an unauthenticated authorization bypass in ISE/ISE-PIC allowing certificate theft (CVSS 5.3), and CVE-2026-76419, a cross-site scripting flaw in Unified CM/Unified CM SME (CVSS 6.1). It also credits the researchers who reported the UCS Central and ISE flaws and provides specific patch version numbers for all three issues.

    Cisco has released fixes for three vulnerabilities affecting UCS Central Software, Identity Services Engine (ISE/ISE-PIC), and Unified Communications Manager (Unified CM/Unified CM SME). The most severe, CVE-2026-76506 (CVSS 7.6), allows an authenticated attacker to achieve remote code execution, arbitrary file writes, and information disclosure via the UCS Central web portal. CVE-2026-20241 (CVSS 5.3) lets an unauthenticated remote attacker bypass authorization checks in ISE/ISE-PIC to obtain an endpoint certificate. CVE-2026-76419 (CVSS 6.1) is a cross-site scripting flaw in the Unified CM web management interface requiring user interaction. Cisco states it is not aware of any public exploitation or proof-of-concept tools, and no workarounds exist for any of the three flaws.

    Technical Details

    CVE-2026-76506 stems from insufficient validation of user-supplied input in HTTP requests on UCS Central versions 2.0 and earlier, and 2.1 builds before 2.1(2c), discovered by Anand Murugan of Gulf Business Machines. CVE-2026-20241, found by Nicholas Michael Kloster, affects ISE/ISE-PIC branches 3.1–3.5 before their latest patches, due to improper authorization checks. CVE-2026-76419, reported by an external researcher, affects Unified CM/Unified CM SME versions 14 and 15 before 15SU5 due to improper input validation enabling stored/reflected script execution.

    Remediation

    Admins should upgrade UCS Central to 2.1(2c) or later; ISE/ISE-PIC to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 (ISE-PIC's last supported branch is 3.4); and Unified CM/Unified CM SME to 15SU5. No workarounds are available, so patching is the only mitigation; restricting network access to web admin portals is also recommended.

  4. sec.cloudapps.cisco.com ↗ · pub. 04/11/2026 13:00 · coletado 04/11 14:00 primeiro registro só resumo do feed

    Cisco UCS Central Software Vulnerable to Authenticated Remote Code Execution

    ler a análise desta fonte

    Cisco has disclosed a vulnerability (CVE-2026-76506) in the web-based management interface of Cisco UCS Central Software that could allow an authenticated, remote attacker to achieve remote code execution or disclose sensitive information on an affected device. The flaw stems from insufficient validation of user-supplied input in HTTP requests. An attacker with valid low-privileged credentials could send a crafted HTTP request to an affected endpoint to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. Cisco rates this a High-severity issue and has released software updates; no workarounds are available.

    Technical Details

    The vulnerability resides in the web-based management interface of Cisco UCS Central Software. Exploitation requires an authenticated attacker to craft a malicious HTTP request to a vulnerable endpoint, leading to arbitrary command execution, arbitrary file writes, and information disclosure.

    Remediation

    Cisco has released software updates addressing CVE-2026-76506. No mitigating workarounds exist, so affected organizations should apply the vendor's patches as soon as possible.