Which versions of OCSReports are affected by CVE-2026-76176?

OCS Inventory NG contains a SQL injection vulnerability in the OCSReports admin interface, allowing authenticated operators to extract or modify inventory database content.

How to fix or mitigate CVE-2026-76176?

Within 24 hours: audit all operator accounts in OCSReports, document current privileged users, and immediately disable unused accounts. Within 7 days: implement network-based access controls restricting OCSReports admin console to authorized management personnel only, deploy database activity monitoring to alert on SQL injection patterns, and review operator role permissions to enforce least-privilege access. Within 30 days: evaluate replacement asset inventory solutions with enhanced security controls, or if OCSReports must be retained, implement input validation filtering on array parameters as a temporary mitigation pending vendor patch availability and subscribe to OCS Security notices for patch announcements.

OCSReports CVE-2026-76176

Q: What is the CVSS score of CVE-2026-76176?

CVE-2026-76176 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-70371 HIGH

SQL Injection (CWE-89)

2026-09-03 INCIBE

GHSA-v2mr-5pjg-76wr

SQLi PHP Ocsreports

8.6

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Operator authentication required (PR:L), network-reachable injection with high C and I impact on application DB, no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 03, 2026 - 10:17 vuln.today

CVE Published

Sep 03, 2026 - 09:47 cve.org

HIGH 8.6

DescriptionCVE.org

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

AnalysisAI

SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level users to manipulate the selected_grp_dupli[] array parameter to alter backend SQL queries and extract or modify data from the application database. All versions are affected per CPE, with the attack requiring only a valid operator account over the network. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session with operator-level privileges in OCSReports - unauthenticated users and lower-privileged accounts cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6, reflecting a network-accessible SQL injection with no attack complexity requiring only operator-level credentials, with high confidentiality and integrity impact on the application's database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version has been independently confirmed from the available data; organizations should consult the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng and the OCS Inventory NG project for any released fix or updated version. … Detailed patch versions, workarounds, and compensating controls in full report.