Cisco patches flaws in UCS Central, ISE and Unified CM

Cisco has released patches for three high-severity vulnerabilities across Cisco UCS Central, Identity Services Engine (ISE) and Unified Communications Manager (Unified CM). The flaws, tracked as CVE-2026-76506, CVE-2026-20241 and CVE-2026-76419, enable remote code execution, certificate theft and cross-site scripting, with Cisco warning there are no workarounds and that installations must be upgraded to fixed builds.

The disclosures also show CVSSv3 scores of 7.6 for CVE-2026-76506, 5.3 for CVE-2026-20241 and 6.1 for CVE-2026-76419, all of which Cisco notes as not yet exploited in public campaigns. Researchers credited in the reporting include Anand Murugan of Gulf Business Machines for the UCS Central bug, with Nicholas Michael Kloster identifying the ISE flaw, and an external researcher reporting the Unified CM issue.

For UCS Central, CVE-2026-76506 permits authenticated remote code execution via insufficient input validation in the web portal; an attacker with valid login credentials can craft HTTP requests to execute arbitrary commands, write files to disk and access private data. CVE-2026-20241 affects ISE and ISE-PIC through improper authorization checks, potentially allowing an unauthenticated remote attacker to bypass access controls to obtain an endpoint certificate.

CVE-2026-76419 targets the Unified CM web portal with cross-site scripting, enabling a malicious link to run script in a logged-in user’s browser and read private page data. Affected versions include UCS Central 2.0 and earlier (and 2.1 before 2.1(2c)); ISE/ISE-PIC branches 3.1–3.5 before the latest patches; and Unified CM/Unified CM SME versions 14 and 15 before 15SU5.

Cisco advises upgrading to the fixed builds: UCS Central 2.1(2c) or later, ISE/ISE-PIC patches (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12; 3.4 Patch 7 or 3.5 Patch 4 on newer branches; note that ISE-PIC is end-of-sale), and Unified CM 15SU5. In all cases, network access to web admin portals should be restricted to trusted hosts.