CVE-2026-20087Disclosure(cisco / enterprise_nfv_infrastructure_software)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch cisco enterprise_nfv_infrastructure_software systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_nfv_infrastructure_software
  • unified_computing_system
  • unified_computing_system_e-series_software

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
Products
enterprise_nfv_infrastructure_softwareunified_computing_systemunified_computing_system_e-series_software

258 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-03: 1Patch / Workaround · 2026-04-03: 1Technical Details · 2026-04-03: 104-03
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Syed Aquib@syedaquib77
    Disclosure

    ⚠️ **Vulnerability Alert:** Cisco IMC multiple vulnerabilities (incl. CVE-2026-20093 authentication bypass) 📅 **Timeline:** Disclosure: 2026-04-01 • Patch: Not Available 🆔 **CVE-2026-20085** | 📊 CVSS: 6.1 (MEDIUM 🟡) | 📈 EPSS: 5.47% 🆔 **CVE-2026-20087** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20088** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20089** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20090** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20093** | 📊 CVSS: 9.8 (CRITICAL 🔴) | 📈 EPSS: 8.77% 🆔 **CVE-2026-20094** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: 57.33% 🆔 **CVE-2026-20095** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20096** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20097** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 19.20% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** IMC on Cisco UCS C‑Series and related server series (various firmware), IMC in Cisco appliances exposing web UI (APIC, Secure Firewall MC, Cyber Vision, Malware Analytics) 🫨 **Attack Vectors:** - Network: crafted HTTP requests (unauthenticated or authenticated depending on CVE) - Reflected and stored XSS via web-management UI - Command injection / code execution via web-management interface - Authentication bypass via malformed password-change request (unauthenticated) 📝 **Summary:** CVE-2026-20093 is an unauthenticated auth-bypass in IMC password-change handling that can grant attacker Admin/root and persistent hardware-level (BMC-like) control. Other flaws include multiple XSS and command-injection issues that, if chained or combined with access, enable credential theft, root execution, lateral movement, and full infrastructure compromise. 📈 **Impact Scope:** Compromise enables persistent out-of-band hardware control, credential theft, privilege escalation to root/Admin, lateral movement, and potential large-scale infrastructure or supply-chain disruption if IMC is reachable or insufficiently segmented. 🛡️ **Recommended Actions:** - Apply Cisco advisories/patches immediately where available - Isolate IMC interfaces: block Internet exposure, restrict to management VLANs and trusted admin subnets - Enforce MFA, rotate credentials, audit account/password changes after remediation - Monitor logs for unauthorized password changes, unexpected root commands, and other IOCs 🪢 **Related Resources:** - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn - https://advisories.ncsc.nl/2026/ncsc-2026-0106.html 🏷 **Tags:** #Cybersecurity #CiscoIMC #UCS

    Post summary

    Cisco has disclosed multiple IMC vulnerabilities, notably CVE-2026‑20093, a critical unauthenticated authentication bypass with high impact, but no patch is currently available; the advisory recommends immediate mitigation steps and monitoring.

    0000049
    276 followersView on X
CPE platform detail262 entries

262 of 262 entries

PartVendorProductVersionTarget SWTarget HW
Appciscoenterprise_nfv_infrastructure_software3.10.1--
Appciscoenterprise_nfv_infrastructure_software3.10.2--
Appciscoenterprise_nfv_infrastructure_software3.10.3--
Appciscoenterprise_nfv_infrastructure_software3.11.1--
Appciscoenterprise_nfv_infrastructure_software3.11.2--
Appciscoenterprise_nfv_infrastructure_software3.11.3--
Appciscoenterprise_nfv_infrastructure_software3.12.1--
Appciscoenterprise_nfv_infrastructure_software3.12.1a--
Appciscoenterprise_nfv_infrastructure_software3.12.1b--
Appciscoenterprise_nfv_infrastructure_software3.12.2--
Appciscoenterprise_nfv_infrastructure_software3.12.3--
Appciscoenterprise_nfv_infrastructure_software3.3.1--
Appciscoenterprise_nfv_infrastructure_software3.4.1--
Appciscoenterprise_nfv_infrastructure_software3.5.1--
Appciscoenterprise_nfv_infrastructure_software3.5.2--
Appciscoenterprise_nfv_infrastructure_software3.6.1--
Appciscoenterprise_nfv_infrastructure_software3.6.2--
Appciscoenterprise_nfv_infrastructure_software3.6.3--
Appciscoenterprise_nfv_infrastructure_software3.7.1--
Appciscoenterprise_nfv_infrastructure_software3.8.1--
Appciscoenterprise_nfv_infrastructure_software3.9.1--
Appciscoenterprise_nfv_infrastructure_software3.9.2--
Appciscoenterprise_nfv_infrastructure_software4.1.1--
Appciscoenterprise_nfv_infrastructure_software4.1.2--
Appciscoenterprise_nfv_infrastructure_software4.10.1--
Appciscoenterprise_nfv_infrastructure_software4.11.1--
Appciscoenterprise_nfv_infrastructure_software4.12.1--
Appciscoenterprise_nfv_infrastructure_software4.12.2--
Appciscoenterprise_nfv_infrastructure_software4.12.3--
Appciscoenterprise_nfv_infrastructure_software4.12.4--
Appciscoenterprise_nfv_infrastructure_software4.12.5--
Appciscoenterprise_nfv_infrastructure_software4.12.6--
Appciscoenterprise_nfv_infrastructure_software4.13.1--
Appciscoenterprise_nfv_infrastructure_software4.14.1--
Appciscoenterprise_nfv_infrastructure_software4.15.1--
Appciscoenterprise_nfv_infrastructure_software4.15.2--
Appciscoenterprise_nfv_infrastructure_software4.15.3--
Appciscoenterprise_nfv_infrastructure_software4.15.4--
Appciscoenterprise_nfv_infrastructure_software4.15.5--
Appciscoenterprise_nfv_infrastructure_software4.16.1--
Appciscoenterprise_nfv_infrastructure_software4.18.1--
Appciscoenterprise_nfv_infrastructure_software4.18.2--
Appciscoenterprise_nfv_infrastructure_software4.18.2a--
Appciscoenterprise_nfv_infrastructure_software4.2.1--
Appciscoenterprise_nfv_infrastructure_software4.2.2--
Appciscoenterprise_nfv_infrastructure_software4.4.1--
Appciscoenterprise_nfv_infrastructure_software4.4.2--
Appciscoenterprise_nfv_infrastructure_software4.4.3--
Appciscoenterprise_nfv_infrastructure_software4.5.1--
Appciscoenterprise_nfv_infrastructure_software4.6.1--
Appciscoenterprise_nfv_infrastructure_software4.6.2--
Appciscoenterprise_nfv_infrastructure_software4.6.2-fc2--
Appciscoenterprise_nfv_infrastructure_software4.6.2-fc3--
Appciscoenterprise_nfv_infrastructure_software4.6.3--
Appciscoenterprise_nfv_infrastructure_software4.6.3-fc4--
Appciscoenterprise_nfv_infrastructure_software4.6.4--
Appciscoenterprise_nfv_infrastructure_software4.6.5-es1--
Appciscoenterprise_nfv_infrastructure_software4.7.1--
Appciscoenterprise_nfv_infrastructure_software4.8.1--
Appciscoenterprise_nfv_infrastructure_software4.8.2--
Appciscoenterprise_nfv_infrastructure_software4.9.1--
Appciscoenterprise_nfv_infrastructure_software4.9.2--
Appciscoenterprise_nfv_infrastructure_software4.9.2-fc5--
Appciscoenterprise_nfv_infrastructure_software4.9.3--
Appciscoenterprise_nfv_infrastructure_software4.9.4--
Appciscoenterprise_nfv_infrastructure_software4.9.4-es8--
Appciscoenterprise_nfv_infrastructure_software4.9.4-es9--
Appciscoenterprise_nfv_infrastructure_software4.9.4-fc3--
Appciscoenterprise_nfv_infrastructure_software4.9.5--
Appciscoenterprise_nfv_infrastructure_software4.9.6--
Appciscounified_computing_system3.1\(1d\)--
Appciscounified_computing_system3.1\(2b\)--
Appciscounified_computing_system3.1\(2c\)--
Appciscounified_computing_system3.1\(2d\)--
Appciscounified_computing_system3.1\(2e\)--
Appciscounified_computing_system3.1\(2g\)--
Appciscounified_computing_system3.1\(2i\)--
Appciscounified_computing_system3.1\(3a\)--
Appciscounified_computing_system3.1\(3b\)--
Appciscounified_computing_system3.1\(3c\)--
Appciscounified_computing_system3.1\(3d\)--
Appciscounified_computing_system3.1\(3g\)--
Appciscounified_computing_system3.1\(3h\)--
Appciscounified_computing_system3.1\(3i\)--
Appciscounified_computing_system3.1\(3j\)--
Appciscounified_computing_system3.1\(3k\)--
Appciscounified_computing_system4.0\(1.240\)--
Appciscounified_computing_system4.0\(1a\)--
Appciscounified_computing_system4.0\(1b\)--
Appciscounified_computing_system4.0\(1c\)--
Appciscounified_computing_system4.0\(1d\)--
Appciscounified_computing_system4.0\(1e\)--
Appciscounified_computing_system4.0\(1g\)--
Appciscounified_computing_system4.0\(1h\)--
Appciscounified_computing_system4.0\(2c\)--
Appciscounified_computing_system4.0\(2d\)--
Appciscounified_computing_system4.0\(2f\)--
Appciscounified_computing_system4.0\(2g\)--
Appciscounified_computing_system4.0\(2h\)--
Appciscounified_computing_system4.0\(2i\)--
Appciscounified_computing_system4.0\(2k\)--
Appciscounified_computing_system4.0\(2l\)--
Appciscounified_computing_system4.0\(2m\)--
Appciscounified_computing_system4.0\(2n\)--
Appciscounified_computing_system4.0\(2o\)--
Appciscounified_computing_system4.0\(2p\)--
Appciscounified_computing_system4.0\(2q\)--
Appciscounified_computing_system4.0\(2r\)--
Appciscounified_computing_system4.0\(4b\)--
Appciscounified_computing_system4.0\(4c\)--
Appciscounified_computing_system4.0\(4d\)--
Appciscounified_computing_system4.0\(4e\)--
Appciscounified_computing_system4.0\(4f\)--
Appciscounified_computing_system4.0\(4h\)--
Appciscounified_computing_system4.0\(4i\)--
Appciscounified_computing_system4.0\(4j\)--
Appciscounified_computing_system4.0\(4k\)--
Appciscounified_computing_system4.0\(4l\)--
Appciscounified_computing_system4.0\(4m\)--
Appciscounified_computing_system4.0\(4n\)--
Appciscounified_computing_system4.1\(1c\)--
Appciscounified_computing_system4.1\(1d\)--
Appciscounified_computing_system4.1\(1f\)--
Appciscounified_computing_system4.1\(1g\)--
Appciscounified_computing_system4.1\(1h\)--
Appciscounified_computing_system4.1\(2a\)--
Appciscounified_computing_system4.1\(2b\)--
Appciscounified_computing_system4.1\(2d\)--
Appciscounified_computing_system4.1\(2e\)--
Appciscounified_computing_system4.1\(2f\)--
Appciscounified_computing_system4.1\(2g\)--
Appciscounified_computing_system4.1\(2h\)--
Appciscounified_computing_system4.1\(2j\)--
Appciscounified_computing_system4.1\(2k\)--
Appciscounified_computing_system4.1\(2l\)--
Appciscounified_computing_system4.1\(2m\)--
Appciscounified_computing_system4.1\(3b\)--
Appciscounified_computing_system4.1\(3c\)--
Appciscounified_computing_system4.1\(3d\)--
Appciscounified_computing_system4.1\(3f\)--
Appciscounified_computing_system4.1\(3g\)--
Appciscounified_computing_system4.1\(3h\)--
Appciscounified_computing_system4.1\(3i\)--
Appciscounified_computing_system4.1\(3l\)--
Appciscounified_computing_system4.1\(3m\)--
Appciscounified_computing_system4.1\(3n\)--
Appciscounified_computing_system4.2\(1a\)--
Appciscounified_computing_system4.2\(1b\)--
Appciscounified_computing_system4.2\(1c\)--
Appciscounified_computing_system4.2\(1e\)--
Appciscounified_computing_system4.2\(1f\)--
Appciscounified_computing_system4.2\(1g\)--
Appciscounified_computing_system4.2\(1i\)--
Appciscounified_computing_system4.2\(1j\)--
Appciscounified_computing_system4.2\(2a\)--
Appciscounified_computing_system4.2\(2f\)--
Appciscounified_computing_system4.2\(2g\)--
Appciscounified_computing_system4.2\(3b\)--
Appciscounified_computing_system4.2\(3d\)--
Appciscounified_computing_system4.2\(3e\)--
Appciscounified_computing_system4.2\(3g\)--
Appciscounified_computing_system4.2\(3h\)--
Appciscounified_computing_system4.2\(3i\)--
Appciscounified_computing_system4.2\(3j\)--
Appciscounified_computing_system4.2\(3k\)--
Appciscounified_computing_system4.2\(3l\)--
Appciscounified_computing_system4.2\(3m\)--
Appciscounified_computing_system4.2\(3n\)--
Appciscounified_computing_system4.2\(3o\)--
Appciscounified_computing_system4.2\(3p\)--
Appciscounified_computing_system4.3\(1.230097\)--
Appciscounified_computing_system4.3\(1.230124\)--
Appciscounified_computing_system4.3\(1.230138\)--
Appciscounified_computing_system4.3\(2.230207\)--
Appciscounified_computing_system4.3\(2.230270\)--
Appciscounified_computing_system4.3\(2.240002\)--
Appciscounified_computing_system4.3\(2.240009\)--
Appciscounified_computing_system4.3\(2.240037\)--
Appciscounified_computing_system4.3\(2.240053\)--
Appciscounified_computing_system4.3\(2.240077\)--
Appciscounified_computing_system4.3\(2.240090\)--
Appciscounified_computing_system4.3\(2.240107\)--
Appciscounified_computing_system4.3\(2.250016\)--
Appciscounified_computing_system4.3\(2.250021\)--
Appciscounified_computing_system4.3\(2.250022\)--
Appciscounified_computing_system4.3\(2.250037\)--
Appciscounified_computing_system4.3\(2.250045\)--
Appciscounified_computing_system4.3\(2.250063\)--
Appciscounified_computing_system4.3\(3.240022\)--
Appciscounified_computing_system4.3\(3.240041\)--
Appciscounified_computing_system4.3\(3.240043\)--
Appciscounified_computing_system4.3\(4.240142\)--
Appciscounified_computing_system4.3\(4.240152\)--
Appciscounified_computing_system4.3\(4.241014\)--
Appciscounified_computing_system4.3\(4.241063\)--
Appciscounified_computing_system4.3\(4.242028\)--
Appciscounified_computing_system4.3\(4.242038\)--
Appciscounified_computing_system4.3\(4.242066\)--
Appciscounified_computing_system4.3\(4.252001\)--
Appciscounified_computing_system4.3\(4.252002\)--
Appciscounified_computing_system4.3\(5.240021\)--
Appciscounified_computing_system4.3\(5.250001\)--
Appciscounified_computing_system4.3\(5.250030\)--
Appciscounified_computing_system4.3\(5.250033\)--
Appciscounified_computing_system4.3\(5.250043\)--
Appciscounified_computing_system4.3\(5.250045\)--
Appciscounified_computing_system4.3\(6.250039\)--
Appciscounified_computing_system4.3\(6.250040\)--
Appciscounified_computing_system4.3\(6.250044\)--
Appciscounified_computing_system4.3\(6.250053\)--
Appciscounified_computing_system4.3\(6.250060\)--
Appciscounified_computing_system4.3\(6.250101\)--
Appciscounified_computing_system4.3\(6.250117\)--
Appciscounified_computing_system4.3\(6.260003\)--
Appciscounified_computing_system6.0\(1.250127\)--
Appciscounified_computing_system6.0\(1.250130\)--
Appciscounified_computing_system6.0\(1.250131\)--
Appciscounified_computing_system6.0\(1.250174\)--
Appciscounified_computing_system6.0\(1.250192\)--
Appciscounified_computing_system6.0\(1.250194\)--
OSciscounified_computing_system_e-series_software2.0.0--
OSciscounified_computing_system_e-series_software2.1.0--
OSciscounified_computing_system_e-series_software2.2.1--
OSciscounified_computing_system_e-series_software2.2.2--
OSciscounified_computing_system_e-series_software2.3.1--
OSciscounified_computing_system_e-series_software2.3.2--
OSciscounified_computing_system_e-series_software2.3.3--
OSciscounified_computing_system_e-series_software2.3.5--
OSciscounified_computing_system_e-series_software2.4.0--
OSciscounified_computing_system_e-series_software2.4.1--
OSciscounified_computing_system_e-series_software2.4.2--
OSciscounified_computing_system_e-series_software3.0.1--
OSciscounified_computing_system_e-series_software3.0.2--
OSciscounified_computing_system_e-series_software3.1.0--
OSciscounified_computing_system_e-series_software3.1.1--
OSciscounified_computing_system_e-series_software3.1.2--
OSciscounified_computing_system_e-series_software3.1.3--
OSciscounified_computing_system_e-series_software3.1.4--
OSciscounified_computing_system_e-series_software3.1.5--
OSciscounified_computing_system_e-series_software3.2.1--
OSciscounified_computing_system_e-series_software3.2.10--
OSciscounified_computing_system_e-series_software3.2.11.1--
OSciscounified_computing_system_e-series_software3.2.11.3--
OSciscounified_computing_system_e-series_software3.2.11.5--
OSciscounified_computing_system_e-series_software3.2.12.2--
OSciscounified_computing_system_e-series_software3.2.13.6--
OSciscounified_computing_system_e-series_software3.2.14--
OSciscounified_computing_system_e-series_software3.2.15--
OSciscounified_computing_system_e-series_software3.2.15.3--
OSciscounified_computing_system_e-series_software3.2.16.1--
OSciscounified_computing_system_e-series_software3.2.2--
OSciscounified_computing_system_e-series_software3.2.3--
OSciscounified_computing_system_e-series_software3.2.4--
OSciscounified_computing_system_e-series_software3.2.6--
OSciscounified_computing_system_e-series_software3.2.7--
OSciscounified_computing_system_e-series_software3.2.8--
OSciscounified_computing_system_e-series_software4.00--
OSciscounified_computing_system_e-series_software4.02--
OSciscounified_computing_system_e-series_software4.11.1--
OSciscounified_computing_system_e-series_software4.12.1--
OSciscounified_computing_system_e-series_software4.12.2--
OSciscounified_computing_system_e-series_software4.15.2--

Explore more