Cisco has patched three vulnerabilities across its data centre, network access and communications products, led by a remote code execution flaw in Cisco UCS Central tracked as CVE-2026-76506. The advisories were published by Cisco's Product Security Incident Response Team on 4 November 2026.

The most serious of the three, CVE-2026-76506, carries a CVSS score of 7.6. It is joined by an authorisation flaw in Cisco Identity Services Engine, CVE-2026-20241, and a cross-site scripting flaw in Cisco Unified Communications Manager, CVE-2026-76419. Cisco says there are no workarounds for any of the three, so administrators need to install the fixed software.

UCS Central: a logged-in user can run commands

CVE-2026-76506 affects the web-based management interface of Cisco UCS Central Software. Cisco says the flaw is caused by insufficient validation of user-supplied input in an HTTP request, and it is classified as a path traversal weakness.

An attacker who already has valid login details can send a crafted HTTP request to the management interface and run arbitrary commands on the system. A successful attack can also write files to disk and read private data, so any authenticated user on the appliance could take over the host or steal stored secrets. The flaw was reported by Anand Murugan of Gulf Business Machines.

It affects UCS Central Software version 2.0 and earlier, and version 2.1 builds before 2.1(2c). The fix is release 2.1(2c) or later, and systems on version 2.0 or earlier need to move to a fixed release.

ISE: unauthenticated attacker can obtain a certificate

CVE-2026-20241, scored 5.3, affects the authorisation checks in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. An unauthenticated remote attacker can send a crafted request to an exposed device and bypass authorisation to obtain an endpoint identity certificate.

Identity Services Engine controls which devices and users are allowed onto a network, so a wrongly issued endpoint certificate is a way to impersonate a trusted device. The flaw was reported by Nicholas Michael Kloster.

The fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11 and 3.3 Patch 12, with 3.4 Patch 7 and 3.5 Patch 4 for the newer branches. ISE-PIC has reached its end-of-sale date, so release 3.4 is its last supported version.

Unified CM: a crafted link runs script in an admin browser

CVE-2026-76419, scored 6.1, is a cross-site scripting flaw in the web-based management interface of Cisco Unified Communications Manager and Unified CM SME. Cisco says the interface does not properly validate user-supplied input.

An unauthenticated attacker can trick a user of the management interface into clicking a crafted link. The script then runs in that user's browser and can read private page data. The flaw affects Unified CM and Unified CM SME versions 14 and 15 before release 15SU5, which is the fixed version.

No workarounds, and no known exploitation

Cisco states in each advisory that there are no workarounds that address the vulnerability. That leaves upgrading as the only fix, and teams should also limit network access to the web management portals so only trusted hosts can reach them.

Cisco's incident response team says it is not aware of any public announcements or malicious use of any of the three flaws. That is the vendor's visibility at publication, rather than proof that no attack has ever happened, but there is no confirmed exploitation to report.

Cisco also said it does not plan to publish more security-hardening advisories for the rest of 2026, with the next planned publication on 20 January 2027. For now, the priority for affected customers is straightforward: check the versions running on management systems and install the fixed builds.