CVE-2026-20089Disclosure(cisco / enterprise_nfv_infrastructure_software)

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch cisco enterprise_nfv_infrastructure_software systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_nfv_infrastructure_software
  • unified_computing_system
  • unified_computing_system_e-series_software

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
Products
enterprise_nfv_infrastructure_softwareunified_computing_systemunified_computing_system_e-series_software

257 versions affected across 3 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-03: 1Patch / Workaround · 2026-04-03: 1Technical Details · 2026-04-03: 104-03
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Syed Aquib@syedaquib77
    Disclosure

    ⚠️ **Vulnerability Alert:** Cisco IMC multiple vulnerabilities (incl. CVE-2026-20093 authentication bypass) 📅 **Timeline:** Disclosure: 2026-04-01 • Patch: Not Available 🆔 **CVE-2026-20085** | 📊 CVSS: 6.1 (MEDIUM 🟡) | 📈 EPSS: 5.47% 🆔 **CVE-2026-20087** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20088** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20089** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20090** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20093** | 📊 CVSS: 9.8 (CRITICAL 🔴) | 📈 EPSS: 8.77% 🆔 **CVE-2026-20094** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: 57.33% 🆔 **CVE-2026-20095** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20096** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20097** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 19.20% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** IMC on Cisco UCS C‑Series and related server series (various firmware), IMC in Cisco appliances exposing web UI (APIC, Secure Firewall MC, Cyber Vision, Malware Analytics) 🫨 **Attack Vectors:** - Network: crafted HTTP requests (unauthenticated or authenticated depending on CVE) - Reflected and stored XSS via web-management UI - Command injection / code execution via web-management interface - Authentication bypass via malformed password-change request (unauthenticated) 📝 **Summary:** CVE-2026-20093 is an unauthenticated auth-bypass in IMC password-change handling that can grant attacker Admin/root and persistent hardware-level (BMC-like) control. Other flaws include multiple XSS and command-injection issues that, if chained or combined with access, enable credential theft, root execution, lateral movement, and full infrastructure compromise. 📈 **Impact Scope:** Compromise enables persistent out-of-band hardware control, credential theft, privilege escalation to root/Admin, lateral movement, and potential large-scale infrastructure or supply-chain disruption if IMC is reachable or insufficiently segmented. 🛡️ **Recommended Actions:** - Apply Cisco advisories/patches immediately where available - Isolate IMC interfaces: block Internet exposure, restrict to management VLANs and trusted admin subnets - Enforce MFA, rotate credentials, audit account/password changes after remediation - Monitor logs for unauthorized password changes, unexpected root commands, and other IOCs 🪢 **Related Resources:** - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn - https://advisories.ncsc.nl/2026/ncsc-2026-0106.html 🏷 **Tags:** #Cybersecurity #CiscoIMC #UCS

    Post summary

    The post announces multiple Cisco IMC CVEs, details their technical impact and attack vectors, notes that patches are not yet available, and urges urgent remediation steps.

    0000049
    276 followersView on X
CPE platform detail261 entries

261 of 261 entries

PartVendorProductVersionTarget SWTarget HW
Appciscoenterprise_nfv_infrastructure_software3.10.1--
Appciscoenterprise_nfv_infrastructure_software3.10.2--
Appciscoenterprise_nfv_infrastructure_software3.10.3--
Appciscoenterprise_nfv_infrastructure_software3.11.1--
Appciscoenterprise_nfv_infrastructure_software3.11.2--
Appciscoenterprise_nfv_infrastructure_software3.11.3--
Appciscoenterprise_nfv_infrastructure_software3.12.1--
Appciscoenterprise_nfv_infrastructure_software3.12.1a--
Appciscoenterprise_nfv_infrastructure_software3.12.1b--
Appciscoenterprise_nfv_infrastructure_software3.12.2--
Appciscoenterprise_nfv_infrastructure_software3.12.3--
Appciscoenterprise_nfv_infrastructure_software3.3.1--
Appciscoenterprise_nfv_infrastructure_software3.4.1--
Appciscoenterprise_nfv_infrastructure_software3.5.1--
Appciscoenterprise_nfv_infrastructure_software3.5.2--
Appciscoenterprise_nfv_infrastructure_software3.6.1--
Appciscoenterprise_nfv_infrastructure_software3.6.2--
Appciscoenterprise_nfv_infrastructure_software3.6.3--
Appciscoenterprise_nfv_infrastructure_software3.7.1--
Appciscoenterprise_nfv_infrastructure_software3.8.1--
Appciscoenterprise_nfv_infrastructure_software3.9.1--
Appciscoenterprise_nfv_infrastructure_software3.9.2--
Appciscoenterprise_nfv_infrastructure_software4.1.1--
Appciscoenterprise_nfv_infrastructure_software4.1.2--
Appciscoenterprise_nfv_infrastructure_software4.10.1--
Appciscoenterprise_nfv_infrastructure_software4.11.1--
Appciscoenterprise_nfv_infrastructure_software4.12.1--
Appciscoenterprise_nfv_infrastructure_software4.12.2--
Appciscoenterprise_nfv_infrastructure_software4.12.3--
Appciscoenterprise_nfv_infrastructure_software4.12.4--
Appciscoenterprise_nfv_infrastructure_software4.12.5--
Appciscoenterprise_nfv_infrastructure_software4.12.6--
Appciscoenterprise_nfv_infrastructure_software4.13.1--
Appciscoenterprise_nfv_infrastructure_software4.14.1--
Appciscoenterprise_nfv_infrastructure_software4.15.1--
Appciscoenterprise_nfv_infrastructure_software4.15.2--
Appciscoenterprise_nfv_infrastructure_software4.15.3--
Appciscoenterprise_nfv_infrastructure_software4.15.4--
Appciscoenterprise_nfv_infrastructure_software4.16.1--
Appciscoenterprise_nfv_infrastructure_software4.18.1--
Appciscoenterprise_nfv_infrastructure_software4.18.2--
Appciscoenterprise_nfv_infrastructure_software4.18.2a--
Appciscoenterprise_nfv_infrastructure_software4.2.1--
Appciscoenterprise_nfv_infrastructure_software4.2.2--
Appciscoenterprise_nfv_infrastructure_software4.4.1--
Appciscoenterprise_nfv_infrastructure_software4.4.2--
Appciscoenterprise_nfv_infrastructure_software4.4.3--
Appciscoenterprise_nfv_infrastructure_software4.5.1--
Appciscoenterprise_nfv_infrastructure_software4.6.1--
Appciscoenterprise_nfv_infrastructure_software4.6.2--
Appciscoenterprise_nfv_infrastructure_software4.6.2-fc2--
Appciscoenterprise_nfv_infrastructure_software4.6.2-fc3--
Appciscoenterprise_nfv_infrastructure_software4.6.3--
Appciscoenterprise_nfv_infrastructure_software4.6.3-fc4--
Appciscoenterprise_nfv_infrastructure_software4.6.4--
Appciscoenterprise_nfv_infrastructure_software4.6.5-es1--
Appciscoenterprise_nfv_infrastructure_software4.7.1--
Appciscoenterprise_nfv_infrastructure_software4.8.1--
Appciscoenterprise_nfv_infrastructure_software4.8.2--
Appciscoenterprise_nfv_infrastructure_software4.9.1--
Appciscoenterprise_nfv_infrastructure_software4.9.2--
Appciscoenterprise_nfv_infrastructure_software4.9.2-fc5--
Appciscoenterprise_nfv_infrastructure_software4.9.3--
Appciscoenterprise_nfv_infrastructure_software4.9.4--
Appciscoenterprise_nfv_infrastructure_software4.9.4-es8--
Appciscoenterprise_nfv_infrastructure_software4.9.4-es9--
Appciscoenterprise_nfv_infrastructure_software4.9.4-fc3--
Appciscoenterprise_nfv_infrastructure_software4.9.5--
Appciscoenterprise_nfv_infrastructure_software4.9.6--
Appciscounified_computing_system3.1\(1d\)--
Appciscounified_computing_system3.1\(2b\)--
Appciscounified_computing_system3.1\(2c\)--
Appciscounified_computing_system3.1\(2d\)--
Appciscounified_computing_system3.1\(2e\)--
Appciscounified_computing_system3.1\(2g\)--
Appciscounified_computing_system3.1\(2i\)--
Appciscounified_computing_system3.1\(3a\)--
Appciscounified_computing_system3.1\(3b\)--
Appciscounified_computing_system3.1\(3c\)--
Appciscounified_computing_system3.1\(3d\)--
Appciscounified_computing_system3.1\(3g\)--
Appciscounified_computing_system3.1\(3h\)--
Appciscounified_computing_system3.1\(3i\)--
Appciscounified_computing_system3.1\(3j\)--
Appciscounified_computing_system3.1\(3k\)--
Appciscounified_computing_system4.0\(1.240\)--
Appciscounified_computing_system4.0\(1a\)--
Appciscounified_computing_system4.0\(1b\)--
Appciscounified_computing_system4.0\(1c\)--
Appciscounified_computing_system4.0\(1d\)--
Appciscounified_computing_system4.0\(1e\)--
Appciscounified_computing_system4.0\(1g\)--
Appciscounified_computing_system4.0\(1h\)--
Appciscounified_computing_system4.0\(2c\)--
Appciscounified_computing_system4.0\(2d\)--
Appciscounified_computing_system4.0\(2f\)--
Appciscounified_computing_system4.0\(2g\)--
Appciscounified_computing_system4.0\(2h\)--
Appciscounified_computing_system4.0\(2i\)--
Appciscounified_computing_system4.0\(2k\)--
Appciscounified_computing_system4.0\(2l\)--
Appciscounified_computing_system4.0\(2m\)--
Appciscounified_computing_system4.0\(2n\)--
Appciscounified_computing_system4.0\(2o\)--
Appciscounified_computing_system4.0\(2p\)--
Appciscounified_computing_system4.0\(2q\)--
Appciscounified_computing_system4.0\(2r\)--
Appciscounified_computing_system4.0\(4b\)--
Appciscounified_computing_system4.0\(4c\)--
Appciscounified_computing_system4.0\(4d\)--
Appciscounified_computing_system4.0\(4e\)--
Appciscounified_computing_system4.0\(4f\)--
Appciscounified_computing_system4.0\(4h\)--
Appciscounified_computing_system4.0\(4i\)--
Appciscounified_computing_system4.0\(4j\)--
Appciscounified_computing_system4.0\(4k\)--
Appciscounified_computing_system4.0\(4l\)--
Appciscounified_computing_system4.0\(4m\)--
Appciscounified_computing_system4.0\(4n\)--
Appciscounified_computing_system4.1\(1c\)--
Appciscounified_computing_system4.1\(1d\)--
Appciscounified_computing_system4.1\(1f\)--
Appciscounified_computing_system4.1\(1g\)--
Appciscounified_computing_system4.1\(1h\)--
Appciscounified_computing_system4.1\(2a\)--
Appciscounified_computing_system4.1\(2b\)--
Appciscounified_computing_system4.1\(2d\)--
Appciscounified_computing_system4.1\(2e\)--
Appciscounified_computing_system4.1\(2f\)--
Appciscounified_computing_system4.1\(2g\)--
Appciscounified_computing_system4.1\(2h\)--
Appciscounified_computing_system4.1\(2j\)--
Appciscounified_computing_system4.1\(2k\)--
Appciscounified_computing_system4.1\(2l\)--
Appciscounified_computing_system4.1\(2m\)--
Appciscounified_computing_system4.1\(3b\)--
Appciscounified_computing_system4.1\(3c\)--
Appciscounified_computing_system4.1\(3d\)--
Appciscounified_computing_system4.1\(3f\)--
Appciscounified_computing_system4.1\(3g\)--
Appciscounified_computing_system4.1\(3h\)--
Appciscounified_computing_system4.1\(3i\)--
Appciscounified_computing_system4.1\(3l\)--
Appciscounified_computing_system4.1\(3m\)--
Appciscounified_computing_system4.1\(3n\)--
Appciscounified_computing_system4.2\(1a\)--
Appciscounified_computing_system4.2\(1b\)--
Appciscounified_computing_system4.2\(1c\)--
Appciscounified_computing_system4.2\(1e\)--
Appciscounified_computing_system4.2\(1f\)--
Appciscounified_computing_system4.2\(1g\)--
Appciscounified_computing_system4.2\(1i\)--
Appciscounified_computing_system4.2\(1j\)--
Appciscounified_computing_system4.2\(2a\)--
Appciscounified_computing_system4.2\(2f\)--
Appciscounified_computing_system4.2\(2g\)--
Appciscounified_computing_system4.2\(3b\)--
Appciscounified_computing_system4.2\(3d\)--
Appciscounified_computing_system4.2\(3e\)--
Appciscounified_computing_system4.2\(3g\)--
Appciscounified_computing_system4.2\(3h\)--
Appciscounified_computing_system4.2\(3i\)--
Appciscounified_computing_system4.2\(3j\)--
Appciscounified_computing_system4.2\(3k\)--
Appciscounified_computing_system4.2\(3l\)--
Appciscounified_computing_system4.2\(3m\)--
Appciscounified_computing_system4.2\(3n\)--
Appciscounified_computing_system4.2\(3o\)--
Appciscounified_computing_system4.2\(3p\)--
Appciscounified_computing_system4.3\(1.230097\)--
Appciscounified_computing_system4.3\(1.230124\)--
Appciscounified_computing_system4.3\(1.230138\)--
Appciscounified_computing_system4.3\(2.230207\)--
Appciscounified_computing_system4.3\(2.230270\)--
Appciscounified_computing_system4.3\(2.240002\)--
Appciscounified_computing_system4.3\(2.240009\)--
Appciscounified_computing_system4.3\(2.240037\)--
Appciscounified_computing_system4.3\(2.240053\)--
Appciscounified_computing_system4.3\(2.240077\)--
Appciscounified_computing_system4.3\(2.240090\)--
Appciscounified_computing_system4.3\(2.240107\)--
Appciscounified_computing_system4.3\(2.250016\)--
Appciscounified_computing_system4.3\(2.250021\)--
Appciscounified_computing_system4.3\(2.250022\)--
Appciscounified_computing_system4.3\(2.250037\)--
Appciscounified_computing_system4.3\(2.250045\)--
Appciscounified_computing_system4.3\(2.250063\)--
Appciscounified_computing_system4.3\(3.240022\)--
Appciscounified_computing_system4.3\(3.240041\)--
Appciscounified_computing_system4.3\(3.240043\)--
Appciscounified_computing_system4.3\(4.240142\)--
Appciscounified_computing_system4.3\(4.240152\)--
Appciscounified_computing_system4.3\(4.241014\)--
Appciscounified_computing_system4.3\(4.241063\)--
Appciscounified_computing_system4.3\(4.242028\)--
Appciscounified_computing_system4.3\(4.242038\)--
Appciscounified_computing_system4.3\(4.242066\)--
Appciscounified_computing_system4.3\(4.252001\)--
Appciscounified_computing_system4.3\(4.252002\)--
Appciscounified_computing_system4.3\(5.240021\)--
Appciscounified_computing_system4.3\(5.250001\)--
Appciscounified_computing_system4.3\(5.250030\)--
Appciscounified_computing_system4.3\(5.250033\)--
Appciscounified_computing_system4.3\(5.250043\)--
Appciscounified_computing_system4.3\(5.250045\)--
Appciscounified_computing_system4.3\(6.250039\)--
Appciscounified_computing_system4.3\(6.250040\)--
Appciscounified_computing_system4.3\(6.250044\)--
Appciscounified_computing_system4.3\(6.250053\)--
Appciscounified_computing_system4.3\(6.250060\)--
Appciscounified_computing_system4.3\(6.250101\)--
Appciscounified_computing_system4.3\(6.250117\)--
Appciscounified_computing_system4.3\(6.260003\)--
Appciscounified_computing_system6.0\(1.250127\)--
Appciscounified_computing_system6.0\(1.250130\)--
Appciscounified_computing_system6.0\(1.250131\)--
Appciscounified_computing_system6.0\(1.250174\)--
Appciscounified_computing_system6.0\(1.250192\)--
Appciscounified_computing_system6.0\(1.250194\)--
OSciscounified_computing_system_e-series_software2.0.0--
OSciscounified_computing_system_e-series_software2.1.0--
OSciscounified_computing_system_e-series_software2.2.1--
OSciscounified_computing_system_e-series_software2.2.2--
OSciscounified_computing_system_e-series_software2.3.1--
OSciscounified_computing_system_e-series_software2.3.2--
OSciscounified_computing_system_e-series_software2.3.3--
OSciscounified_computing_system_e-series_software2.3.5--
OSciscounified_computing_system_e-series_software2.4.0--
OSciscounified_computing_system_e-series_software2.4.1--
OSciscounified_computing_system_e-series_software2.4.2--
OSciscounified_computing_system_e-series_software3.0.1--
OSciscounified_computing_system_e-series_software3.0.2--
OSciscounified_computing_system_e-series_software3.1.0--
OSciscounified_computing_system_e-series_software3.1.1--
OSciscounified_computing_system_e-series_software3.1.2--
OSciscounified_computing_system_e-series_software3.1.3--
OSciscounified_computing_system_e-series_software3.1.4--
OSciscounified_computing_system_e-series_software3.1.5--
OSciscounified_computing_system_e-series_software3.2.1--
OSciscounified_computing_system_e-series_software3.2.10--
OSciscounified_computing_system_e-series_software3.2.11.1--
OSciscounified_computing_system_e-series_software3.2.11.3--
OSciscounified_computing_system_e-series_software3.2.11.5--
OSciscounified_computing_system_e-series_software3.2.12.2--
OSciscounified_computing_system_e-series_software3.2.13.6--
OSciscounified_computing_system_e-series_software3.2.14--
OSciscounified_computing_system_e-series_software3.2.15--
OSciscounified_computing_system_e-series_software3.2.15.3--
OSciscounified_computing_system_e-series_software3.2.16.1--
OSciscounified_computing_system_e-series_software3.2.2--
OSciscounified_computing_system_e-series_software3.2.3--
OSciscounified_computing_system_e-series_software3.2.4--
OSciscounified_computing_system_e-series_software3.2.6--
OSciscounified_computing_system_e-series_software3.2.7--
OSciscounified_computing_system_e-series_software3.2.8--
OSciscounified_computing_system_e-series_software4.00--
OSciscounified_computing_system_e-series_software4.02--
OSciscounified_computing_system_e-series_software4.11.1--
OSciscounified_computing_system_e-series_software4.12.1--
OSciscounified_computing_system_e-series_software4.12.2--
OSciscounified_computing_system_e-series_software4.15.2--

Explore more