Cisco Patches High-Severity Remote Code Execution in UCS Central Alongside ISE and Unified CM Flaws

TL;DR

Cisco released important updates to fix three bugs in Cisco UCS Central, Identity Services Engine (ISE), and Unified CM. Tracked as CVE-2026-76506, CVE-2026-20241, and CVE-2026-76419, these flaws allow remote code execution, cert theft, and script attacks. Because no workarounds exist, network admins must install the fixed builds right away.

Why It Matters

Cisco UCS Central, ISE, and Unified CM control key data center servers, network access rules, and office phone systems. Therefore, security bugs in these tools expose core server tasks and user data to network attackers. Both the official Cisco PSIRT reports and the MITRE CVE database confirm the impact of these three flaws.

Currently, the vendor states that “The Cisco PSIRT is not aware of any public announcements or malicious use.” Thus, no active attacks in the wild or public exploit tools have been confirmed yet. Researcher Anand Murugan of Gulf Business Machines reported the UCS bug, while Nicholas Michael Kloster found the ISE flaw. An external researcher reported the Unified CM bug. Although exact install counts remain private, thousands of firms use these Cisco tools for daily IT operations.

How the Attack Works

Authenticated Remote Code Execution in UCS Central (CVE-2026-76506)

First, CVE-2026-76506 (CVSS 7.6, Bug ID CSCwv60193) hits the web portal of Cisco UCS Central Software. Per the Cisco UCS Central security advisory, “This vulnerability is due to insufficient validation of user-supplied input in an HTTP request.” An attacker with valid login details can send a bad HTTP request to a target page.

Consequently, a working attack lets the user run arbitrary commands on the system. They can also write files to the disk and read private data. Therefore, any logged-in user on the appliance can hijack the host or steal stored secrets.

Unauthenticated Certificate Access in ISE (CVE-2026-20241)

Second, CVE-2026-20241 (CVSS 5.3, Bug ID CSCwu26099) affects the access checks in Cisco ISE and ISE-PIC. In the Cisco ISE security advisory, the team states that “This vulnerability is due to improper authorization checks.” An unauthenticated remote attacker can send a crafted request to an exposed device. As the vendor warns, “A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate.”

Cross-Site Scripting in Unified CM (CVE-2026-76419)

Third, CVE-2026-76419 (CVSS 6.1, Bug ID CSCwv01048) hits the web portal of Cisco Unified CM and Unified CM SME. According to the Cisco Unified CM security advisory, “the web-based management interface does not properly validate user-supplied input.” An attacker can exploit this flaw by tricking a portal user into clicking a bad link. Once clicked, the script runs in the user’s browser and reads private page data.

Affected Versions

All three flaws affect their target systems regardless of how admins set up the devices. Specifically, CVE-2026-76506 hits Cisco UCS Central Software versions 2.0 and earlier. It also affects version 2.1 builds before 2.1(2c). Meanwhile, CVE-2026-20241 affects Cisco ISE and ISE-PIC branches 3.1, 3.2, 3.3, 3.4, and 3.5 before the newest patch levels. Finally, CVE-2026-76419 impacts Unified CM and Unified CM SME versions 14 and 15 before 15SU5.

Patch and Mitigation Steps

Cisco states in each report that “There are no workarounds that address this vulnerability.” As a result, admins must update their systems to the fixed software builds right away. For Cisco UCS Central, teams should move to release 2.1(2c) or later. Users on version 2.0 and earlier must move to a fixed branch.

For Cisco ISE and ISE-PIC, admins should install 3.1 Patch 12, 3.2 Patch 11, or 3.3 Patch 12. Users on newer branches must install 3.4 Patch 7 or 3.5 Patch 4. Note that ISE-PIC reached its end-of-sale date, so release 3.4 is its last supported version. Finally, Unified CM and Unified CM SME admins must update to release 15SU5. In addition, teams should limit network access to all web admin portals so only trusted hosts can reach them.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.