# CVE-2026-76176: OCS Inventory NG Ocsreports SQL injection in admin_double endpoint

Source: https://junglewise.ai/threats/cve-2026-76176-ocs-inventory-ng-ocsreports-sql-injection-in-admin-double  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76176 · Severity: info · CVSS 8.6 · Published 2026-09-03

OCS Inventory NG's Ocsreports component is an asset management system that tracks hardware and software across corporate IT infrastructure. A SQL injection vulnerability in the admin_double endpoint allows authenticated operators to bypass database query safeguards and extract sensitive inventory data, including potentially confidential hardware and software information.

## Quick answers

**Is CVE-2026-76176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76176 being exploited in the wild.

**How severe is CVE-2026-76176?** Informational severity, with a CVSS score of 8.6, published 3 September 2026.

**Which products and versions are affected?** OCS Inventory Ocsreports 2.12.4 and earlier.

**Is there a fix for CVE-2026-76176?** A patch was published on 2026-09-03: Fixed in version 2.12.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76176 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76176?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the /ocsreports/index.php?function=admin_double endpoint where the selected_grp_dupli[] parameter's ID field values are improperly processed and directly incorporated into SQL queries without parameterization or validation (CWE-89). An authenticated user with operator-level privileges can craft malicious SQL payloads within the ID field to alter query logic and extract database records. The attack requires valid authentication and operator privileges but no user interaction or special conditions; the vulnerability is network-accessible. Successful exploitation allows an attacker to enumerate and exfiltrate arbitrary data from the OCS Inventory NG database. A fix is available in version 2.12.6.

## Affected products

- OCS Inventory Ocsreports 2.12.4 and earlier

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 2.12.6

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng)