Vulnerability · Published Sep 3, 2026 · Assigned by INCIBE

CVE-2026-76176Multiple vulnerabilities in Ocsreports for OCS Inventory NG

High 8.6

In plain English

A high-severity SQL injection in Ocsreports from OCS Inventory NG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ocsinventory-server	no fix listed	DEBIAN-CVE-2026-76176
Ubuntu:22.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76176
Ubuntu:24.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76176

Affected products (as reported)

Vendor	Product	Versions
OCS Inventory NG	Ocsreports	2.12.6

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng