CVE-2026-76506High· 7.6▾ TwilightA vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This v…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.
This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.
unified_computing_system_central_software 2.0(1e)unified_computing_system_central_software 2.0(1a)unified_computing_system_central_software 2.0(1h)unified_computing_system_central_software 2.0(1g)unified_computing_system_central_software 2.0(1c)unified_computing_system_central_software 2.0(1k)unified_computing_system_central_software 2.0(1l)unified_computing_system_central_software 2.0(1f)unified_computing_system_central_software 2.0(1j)unified_computing_system_central_software 2.0(1b)unified_computing_system_central_software 2.0(1i)unified_computing_system_central_software 2.0(1d)unified_computing_system_central_software 2.0(1m)unified_computing_system_central_software 2.0(1n)unified_computing_system_central_software 2.0(1o)unified_computing_system_central_software 2.0(1p)unified_computing_system_central_software 2.0(1q)unified_computing_system_central_software 2.0(1r)unified_computing_system_central_software 2.0(1s)unified_computing_system_central_software 2.0(1t)unified_computing_system_central_software 2.0(1u)unified_computing_system_central_software 2.0(1v)unified_computing_system_central_software 2.0(1w)unified_computing_system_central_software 2.1(1a)unified_computing_system_central_software 2.1(1b)unified_computing_system_central_software 2.1(1c)unified_computing_system_central_software 2.1(2a)unified_computing_system_central_software 2.1(2b)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-3365Medium· 4.3A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories
CVE-2020-3236Medium· 6.7A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files
CVE-2020-3550High· 8.1A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories…
CVE-2020-3187Critical· 9.1A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks an…
CVE-2022-20818High· 7.8Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges
CVE-2026-76479High· 7.8Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities