Vulnerability · Published Sep 3, 2026 · Assigned by INCIBE

CVE-2026-76177Multiple vulnerabilities in Ocsreports for OCS Inventory NG

High 7.1

In plain English

A high-severity server-side request forgery in Ocsreports from OCS Inventory NG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ocsinventory-server	no fix listed	DEBIAN-CVE-2026-76177
Ubuntu:22.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76177
Ubuntu:24.04:LTS	ocsinventory-server	no fix listed	UBUNTU-CVE-2026-76177

Affected products (as reported)

Vendor	Product	Versions
OCS Inventory NG	Ocsreports	2.12.6

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng