CVE-2026-76177

Name of the Vulnerable Software and Affected Versions OCS Inventory (affected versions not specified)

Description An authenticated user with operator privileges can exploit a Server-Side Request Forgery (SSRF) issue. This occurs due to insufficient validation of the HTTPS SERV and FILE SERV parameters at the '/ocsreports/?function=tele activate' endpoint. An attacker can provide arbitrary values to these parameters, forcing the server to make HTTP/HTTPS requests to external systems or internal resources, potentially granting access to internal network services or cloud service metadata resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the HTTPS SERV and FILE SERV parameters in the '/ocsreports/?function=tele activate' endpoint until the issue is resolved.