---
title: Cisco's Nov 4 advisories: authenticated RCE in UCS Central (CVE-2026-76506), ISE endpoint-certificate authorization bypass, CUCM XSS | ctxsec
url: https://ctxsec.com/items/cisco-nov-4-advisories-ucs-central-rce-ise-cert-cucm-xss
description: "Cisco published three advisories on Nov 4. In UCS Central Software, a path-traversal flaw in the web management interface (CVE-2026-76506, CVSS 7.6) lets an attacker with valid credentials run commands, write files and read sensitive data. It's fixed in 2.1(2c), and 2.0 and earlier must migrate. In ISE and ISE-PIC, an authorization flaw (CVE-2026-20241, 5.3) lets an unauthenticated remote attacker obtain an endpoint identity certificate. It's fixed in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Unified Communications Manager has an XSS (CVE-2026-76419, 6.1). Cisco knows of no exploitation and offers no workarounds. Cisco also says it won't publish more hardening-release advisories this year; the next is planned for Jan 20, 2027."
status: "official (Cisco PSIRT, Nov 4; no known exploitation)"
published: 2026-11-04
---

> Cisco published three advisories on Nov 4. In UCS Central Software, a path-traversal flaw in the web management interface (CVE-2026-76506, CVSS 7.6) lets an attacker with valid credentials run commands, write files and read sensitive data. It's fixed in 2.1(2c), and 2.0 and earlier must migrate. In ISE and ISE-PIC, an authorization flaw (CVE-2026-20241, 5.3) lets an unauthenticated remote attacker obtain an endpoint identity certificate. It's fixed in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Unified Communications Manager has an XSS (CVE-2026-76419, 6.1). Cisco knows of no exploitation and offers no workarounds. Cisco also says it won't publish more hardening-release advisories this year; the next is planned for Jan 20, 2027.

[← Cybersecurity News](/news) · [markdown](/items/cisco-nov-4-advisories-ucs-central-rce-ise-cert-cucm-xss.md)

official (Cisco PSIRT, Nov 4; no known exploitation)

2026-11-04

### Cisco's Nov 4 advisories: authenticated RCE in UCS Central (CVE-2026-76506), ISE endpoint-certificate authorization bypass, CUCM XSS

- **UCS Central:** upgrade to 2.1(2c), and restrict the management UI to admin networks.
- **ISE / ISE-PIC:** apply the patch for your branch. A stolen endpoint certificate could let an attacker pose as a managed device to certificate-based network access, so check certificate issuance logs for requests you can't explain. ISE-PIC is end-of-sale, and 3.4 is its last supported release.

Sources: [Cisco: UCS Central Software RCE (cisco-sa-cucs-rce-LzHSFRDQ)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ) · [Cisco: ISE Authorization Bypass (cisco-sa-ise-cert-mE9BD5GO)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO) · [Cisco: CUCM XSS (cisco-sa-cucm-xss-5mQn2U5z)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z) · [Cisco: Notice for Nov 4, 2026 advisories](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-I8z3n6lK)