The vulnerability is caused by insufficient validation of user-supplied input in an HTTP request to the web‑based management interface of Cisco UCS Central Software. An attacker with valid credentials and remote access can craft a request that causes the server to execute arbitrary commands, write arbitrary files to the filesystem, or glean sensitive information. This leads to a full compromise of the affected device, allowing attackers to run any code with the privileges of the UCS Central service.

Cisco UCS Central Software from Cisco. No specific versions are listed in the advisory, so any installation of the software that has not been updated to the versions addressed by Cisco’s patch is potentially vulnerable.

The CVSS score of 7.6 reflects a high‑severity flaw. No EPSS score is provided and the vulnerability is not in the CISA KEV catalog, indicating that no public exploit is currently documented. The described attack requires an authenticated user; therefore, the likelihood of exploitation depends on the compromise of valid credentials or weak authentication practices. If an attacker obtains legitimate credentials, they can remotely trigger the flaw by sending a crafted HTTP request to the affected endpoint.