CVE-2026-76177— Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Quick assessment
Affected
OCS Inventory NG Ocsreports
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是对该漏洞描述信息的中文翻译： 服务端请求伪造（SSRF）漏洞 端点存在服务端请求伪造（SSRF）漏洞，原因是 和 参数的校验不足。 拥有操作员权限的已认证用户可以为这些参数提供任意值，从而诱导 OCS Inventory 服务器向外部系统或内部资源发起 HTTP/HTTPS 请求，这可能允许访问内部网络服务或云服务的元数据资源。
Possible ATT&CK Techniques 2 AI
T1210 · Exploitation of Remote Services T1071.002 · File Transfer ProtocolsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OCS Inventory NG | Ocsreports | 2.12.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76177
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OCS Inventory NG | Ocsreports | 2.12.6 | - |
|
II. Public POCs for CVE-2026-76177
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76177
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76177 (1)
Same Patch Batch · OCS Inventory NG · 2026-09-03 · 5 CVEs total
| CVE-2026-76174 | 9.4 CRITICAL | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76178 | 9.2 CRITICAL | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76176 | 8.6 HIGH | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
| CVE-2026-76175 | 8.6 HIGH | Multiple vulnerabilities in Ocsreports for OCS Inventory NG |
IV. Related Vulnerabilities
Same product: Ocsreports
Same vendor: OCS Inventory NG
Same weakness: CWE-918
-
CVE-2026-85380
light0011 cms UEditor controller.php catchimage server-side -
CVE-2026-65818
Power Automate Elevation of Privilege Vulnerability -
CVE-2026-85305
WordPress SEOPress plugin <= 10.1 - Server Side Request Forg -
CVE-2026-84761
WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Reques -
CVE-2026-85242
Server-Side Request Forgery via Favicon Redirect to Local Ne
V. Comments for CVE-2026-76177
No comments yet