Cisco has patched a command-execution flaw in UCS Central, CVE-2026-76506, along with an authorization bypass in Identity Services Engine and a cross-site scripting bug in Unified Communications Manager. The company has no workarounds for any of the three, and Cisco’s Product Security Incident Response Team (PSIRT) says it is not aware of public announcements or malicious use.
CVE-2026-76506 Lets an Authenticated UCS Central User Run Commands
The most severe of the three, CVE-2026-76506, carries a CVSS score of 7.6. It is an input validation flaw in the UCS Central web portal. An authenticated user can exploit it to run arbitrary commands, write files and read data on the system. UCS Central versions 2.0 and earlier are affected, along with 2.1 releases before 2.1(2c). Anand Murugan of Gulf Business Machines reported the flaw.
UCS Central is the management layer for Cisco’s data center server fleets, so an authenticated foothold there reaches systems well beyond a single host. The authentication requirement limits who can attack, but any account with portal access qualifies.
Identity Services Engine Authorization Bypass CVE-2026-20241 Exposes Endpoint Certificates
CVE-2026-20241 affects Cisco Identity Services Engine (ISE) and ISE-PIC and carries a CVSS score of 5.3. An unauthenticated remote attacker can use the authorization bypass to obtain an endpoint certificate. The affected branches run from 3.1 to 3.5. Nicholas Michael Kloster reported it.
Why an ISE Endpoint Certificate Matters for Network Access Control
ISE enforces network access policy, and endpoint certificates are one of the ways devices prove their identity to it. The advisory rates the flaw at a medium level, and the material it exposes is limited to a certificate rather than administrative control of the platform.
Fixed ISE Patch Levels Across Five Branches
Cisco released fixes for each affected branch: ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE-PIC 3.4 is the last supported release of that product.
Unified CM Cross-Site Scripting Bug CVE-2026-76419 Affects Versions 14 and 15
CVE-2026-76419 is a cross-site scripting flaw in the web interface of Unified Communications Manager (Unified CM) and Unified CM Session Management Edition. It has a CVSS score of 6.1. Versions 14 and 15 before 15SU5 are affected, and 15SU5 contains the fix.
Cisco’s description of the UCS Central flaw packs three capabilities into one input validation failure: command execution, file writes and data reads. On the ISE side, the note that ISE-PIC 3.4 is the last supported release means customers on that product have no later branch to move to when future fixes arrive.
Cross-site scripting bugs typically require a user to interact with a crafted link or page, which sets them apart from the other two flaws in the group. Unified CM runs telephony call control for organizations, and its administrative web interface is the surface involved.
Cisco Offers No Workarounds for CVE-2026-76506, CVE-2026-20241 and CVE-2026-76419
Cisco states that none of the three vulnerabilities has a workaround. The company recommends restricting web administration portals to trusted hosts, a measure that reduces exposure to the authenticated and cross-site scripting attacks by limiting who can reach the interface at all.
The three flaws sit in systems that organizations place at the core of data center operations, network access control and telephony management. None carries a critical rating, and Cisco reports no evidence of exploitation. The scores nevertheless span the three categories of attack that defenders weigh differently: an authenticated user with a path to command execution, an unauthenticated remote request that yields a credential-related artifact, and a browser-side bug that depends on a victim’s action.
Because the vendor offers only patches, the practical timetable for closing the exposure follows each organization’s change-control schedule for the ISE patch levels, the UCS Central 2.1(2c) release and Unified CM 15SU5.
