External risk intelligence

Ocsreports Unrestricted File Upload Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-76174

The vulnerability exists within an administrative endpoint (admin_info) and requires administrator privileges to exploit. While the application is web-based, administrative interfaces are typically restricted to internal networks or secured via access controls, making direct public internet exposure uncommon in standard deployment configurations.

Unrestricted File Upload

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves unrestricted file uploads in the Ocsreports system, specifically when an administrator uploads a CSV file. If a malicious PHP file is uploaded and then processed by the web server, it could allow for the execution of arbitrary code, potentially impacting the server's operations.

Administrators can upload malicious files.
Critical to confirm if this internal system is exposed externally.
Assess administrative interfaces for potential misuse.

Attack Path

How an attacker could exploit the issue

An attacker with administrator privileges could upload a malicious PHP file through the CSV upload feature. If the server processes this file, the attacker could then execute arbitrary code on the web service.

Requires administrator privileges.
Uploads a malicious PHP file.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An unrestricted file upload vulnerability could allow an authenticated administrator to upload and execute arbitrary PHP code on the server when supported by the advisory's conditions. This could occur if the application fails to properly validate uploaded CSV files, treating them as executable PHP code instead of data.

Arbitrary PHP code execution.
Uploading malicious files via admin endpoint.
Server compromise with web service privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability within the Ocsreports CSV upload functionality likely falls under the purview of the application or platform team responsible for managing the Ocsreports system. The immediate first step is to identify all instances of the affected Ocsreports installation, confirm their network exposure and criticality, and then engage the system's accountable owner to plan remediation.

Application or platform team owns the issue.
Verify system exposure and administrative access.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ocsreports and how is it used?

Ocsreports is the web-based administrative management interface for OCS Inventory NG, a software suite designed for IT asset management and network inventory. Organizations use this platform to collect data about hardware and software across their infrastructure. The admin_info endpoint, where this issue resides, is a specific component used for processing administrative data uploads.

How does CVE-2026-76174 allow arbitrary code execution?

This vulnerability is classified as CWE-434, or Unrestricted Upload of File with Dangerous Type. It occurs because the software trusts the file name provided during a CSV upload without verifying the actual file content. Because the system fails to restrict file types, an authenticated user can upload a PHP script. If the server is configured to process files in that directory, it executes the script as if it were legitimate application code.

What steps must an attacker take to trigger this bug?

Exploitation requires two specific preconditions: the attacker must first possess valid administrator privileges for the Ocsreports interface, and they must successfully upload a malicious PHP file through the CSV upload feature. Simply having network access is insufficient; the attack will not trigger if the user lacks these elevated credentials, as the system does not allow non-administrative users to access the vulnerable endpoint.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels this as Unlikely because the vulnerability is located within an administrative endpoint. Since these interfaces are generally intended for internal management and are often shielded by network-level access controls, they are rarely exposed directly to the public internet in standard deployments. Risk increases if your specific configuration inadvertently places this administrative panel on the open web.

How should I respond to CVE-2026-76174?

The immediate priority is to locate all instances of Ocsreports within your environment to understand your footprint. Confirm whether the administrative interface is accessible from outside your private network. Once identified, work with the team responsible for the application to restrict access to the affected endpoint and prepare for official updates that address the file validation logic.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.