VulnSocial

CVE-2026-20094Disclosure(cisco / unified_computing_system)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch cisco unified_computing_system systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.

cisco CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-77

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • unified_computing_system
  • unified_computing_system_e-series_software

Threat summary

  • Patch or workaround signal is available
  • 7 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 6 signals
  • Disclosure: 4 classified signals
  • General: 2 classified signals
  • Peaked 3d ago at 4 mentions (2026-04-02); latest day: 1
  • 7 total mentions across 4 days

Affected systems

Vendors
cisco
Products
unified_computing_systemunified_computing_system_e-series_software

192 versions affected across 2 products

Deep dive

Activity timeline7 mentions / 4d
01234Mentions · 2026-04-02: 4Mentions · 2026-04-03: 1Mentions · 2026-04-09: 1Mentions · 2026-04-15: 1Patch / Workaround · 2026-04-02: 1Patch / Workaround · 2026-04-03: 1Technical Details · 2026-04-02: 4Technical Details · 2026-04-03: 1Technical Details · 2026-04-09: 104-0204-0304-0904-15
Signal classification3 categories
Disclosure
457.1%
General
228.6%
Patch
114.3%
Referenced assets9 URLs
Classification over time
DateTotalLabels
2026-04-024
Disclosure3Patch1
2026-04-031
Disclosure1
2026-04-091
General1
2026-04-151
General1
Full discourse7 posts
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos Cisco ❗ CVE-2026-20160 ❗ CVE-2026-20094 ❗ CVE-2026-20093 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-cisco-13/ https://t.co/4iMQautx5v

    Post summary

    Three recent Cisco product CVEs are listed with a link to a CERT.gov.py page for further information.

    00020120
    6.7K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: Critical flaws in #Cisco products. #CVE-2026-20160 CVSS: 9.8. #CVE-2026-20094 #CVE-2026-20095 #CVE-2026-20096 #CVE-2026-20097 and #CVE-2026-20155. These can lead to #RCE, root compromise, or exposure of sensitive session data! https://ccb.belgium.be/advisories/warning-remote-code-execution-vulnerabilities-multiple-cisco-products-patch-immediately #Patch #Patch #Patch

    Post summary

    The advisory warns of multiple critical Cisco CVEs that enable remote code execution and root compromise, and urges users to apply patches immediately.

    01000205
    7.2K followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    There is a new vulnerability with elevated criticality in Cisco Unified Computing System and Unified Computing System E-Series Software (CVE-2026-20094) https://vuldb.com/vuln/354716

    Post summary

    The post announces the discovery of CVE‑2026‑20094 with critical severity in Cisco Unified Computing System products, providing only basic severity and CVE identification.

    00010108
    2.1K followersView on X
  • IntegSec@integ_sec
    General

    CVE-2026-20094: Cisco IMC Command Injection - What It Means for Your Business and How to Respond https://hubs.li/Q04b9Rzp0

    Post summary

    The text offers a high‑level overview of CVE‑2026‑20094, naming it a Cisco IMC command injection but providing no details on exploit code, active attacks, or remediation.

    0000066
    28 followersView on X
  • Syed Aquib@syedaquib77
    Disclosure

    ⚠️ **Vulnerability Alert:** Cisco IMC multiple vulnerabilities (incl. CVE-2026-20093 authentication bypass) 📅 **Timeline:** Disclosure: 2026-04-01 • Patch: Not Available 🆔 **CVE-2026-20085** | 📊 CVSS: 6.1 (MEDIUM 🟡) | 📈 EPSS: 5.47% 🆔 **CVE-2026-20087** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20088** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20089** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20090** | 📊 CVSS: 4.8 (MEDIUM 🟡) | 📈 EPSS: 9.70% 🆔 **CVE-2026-20093** | 📊 CVSS: 9.8 (CRITICAL 🔴) | 📈 EPSS: 8.77% 🆔 **CVE-2026-20094** | 📊 CVSS: 8.8 (HIGH 🟠) | 📈 EPSS: 57.33% 🆔 **CVE-2026-20095** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20096** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 24.33% 🆔 **CVE-2026-20097** | 📊 CVSS: 6.5 (MEDIUM 🟡) | 📈 EPSS: 19.20% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** IMC on Cisco UCS C‑Series and related server series (various firmware), IMC in Cisco appliances exposing web UI (APIC, Secure Firewall MC, Cyber Vision, Malware Analytics) 🫨 **Attack Vectors:** - Network: crafted HTTP requests (unauthenticated or authenticated depending on CVE) - Reflected and stored XSS via web-management UI - Command injection / code execution via web-management interface - Authentication bypass via malformed password-change request (unauthenticated) 📝 **Summary:** CVE-2026-20093 is an unauthenticated auth-bypass in IMC password-change handling that can grant attacker Admin/root and persistent hardware-level (BMC-like) control. Other flaws include multiple XSS and command-injection issues that, if chained or combined with access, enable credential theft, root execution, lateral movement, and full infrastructure compromise. 📈 **Impact Scope:** Compromise enables persistent out-of-band hardware control, credential theft, privilege escalation to root/Admin, lateral movement, and potential large-scale infrastructure or supply-chain disruption if IMC is reachable or insufficiently segmented. 🛡️ **Recommended Actions:** - Apply Cisco advisories/patches immediately where available - Isolate IMC interfaces: block Internet exposure, restrict to management VLANs and trusted admin subnets - Enforce MFA, rotate credentials, audit account/password changes after remediation - Monitor logs for unauthorized password changes, unexpected root commands, and other IOCs 🪢 **Related Resources:** - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn - https://advisories.ncsc.nl/2026/ncsc-2026-0106.html 🏷 **Tags:** #Cybersecurity #CiscoIMC #UCS

    Post summary

    The post announces several Cisco IMC CVEs, notably a critical unauthenticated authentication bypass (CVE-2026-20093), provides technical details and mitigations, and notes that no patch is yet available.

    0000049
    276 followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-20094: HIGH] Cisco IMC has a critical vulnerability allowing remote attackers to inject commands and potentially gain root access. Ensure system security through proper input validation.#cve,CVE-2026-20094,#cybersecurity https://cvefind.com/CVE-2026-20094

    Post summary

    The tweet reports a high‑severity command‑injection flaw in Cisco IMC that could enable root access, but it does not mention active exploitation, mitigation steps, or a PoC.

    0000036
    617 followersView on X
  • dbugs@ptdbugs
    Disclosure

    Cisco Integrated Management Controller Command Injection Vulnerability CVE: CVE-2026-20094 PT-ID: PT-2026-29557 Vendor: Cisco Product: Cisco Unified Computing System (Standalone) CVSS: 8.8 Credits: n/a Description: A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-20094 • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt #dbugs_vuln

    Post summary

    A new command injection vulnerability (CVE-2026-20094) in Cisco IMC has been disclosed, offering remote authenticated read‑only users the ability to execute arbitrary root commands, but no proof of concept, exploit code, active exploitation, or patch information is present.

    00000144
    781 followersView on X
CPE platform detail192 entries

192 of 192 entries

PartVendorProductVersionTarget SWTarget HW
Appciscounified_computing_system3.1\(1d\)--
Appciscounified_computing_system3.1\(2b\)--
Appciscounified_computing_system3.1\(2c\)--
Appciscounified_computing_system3.1\(2d\)--
Appciscounified_computing_system3.1\(2e\)--
Appciscounified_computing_system3.1\(2g\)--
Appciscounified_computing_system3.1\(2i\)--
Appciscounified_computing_system3.1\(3a\)--
Appciscounified_computing_system3.1\(3b\)--
Appciscounified_computing_system3.1\(3c\)--
Appciscounified_computing_system3.1\(3d\)--
Appciscounified_computing_system3.1\(3g\)--
Appciscounified_computing_system3.1\(3h\)--
Appciscounified_computing_system3.1\(3i\)--
Appciscounified_computing_system3.1\(3j\)--
Appciscounified_computing_system3.1\(3k\)--
Appciscounified_computing_system4.0\(1.240\)--
Appciscounified_computing_system4.0\(1a\)--
Appciscounified_computing_system4.0\(1b\)--
Appciscounified_computing_system4.0\(1c\)--
Appciscounified_computing_system4.0\(1d\)--
Appciscounified_computing_system4.0\(1e\)--
Appciscounified_computing_system4.0\(1g\)--
Appciscounified_computing_system4.0\(1h\)--
Appciscounified_computing_system4.0\(2c\)--
Appciscounified_computing_system4.0\(2d\)--
Appciscounified_computing_system4.0\(2f\)--
Appciscounified_computing_system4.0\(2g\)--
Appciscounified_computing_system4.0\(2h\)--
Appciscounified_computing_system4.0\(2i\)--
Appciscounified_computing_system4.0\(2k\)--
Appciscounified_computing_system4.0\(2l\)--
Appciscounified_computing_system4.0\(2m\)--
Appciscounified_computing_system4.0\(2n\)--
Appciscounified_computing_system4.0\(2o\)--
Appciscounified_computing_system4.0\(2p\)--
Appciscounified_computing_system4.0\(2q\)--
Appciscounified_computing_system4.0\(2r\)--
Appciscounified_computing_system4.0\(4b\)--
Appciscounified_computing_system4.0\(4c\)--
Appciscounified_computing_system4.0\(4d\)--
Appciscounified_computing_system4.0\(4e\)--
Appciscounified_computing_system4.0\(4f\)--
Appciscounified_computing_system4.0\(4h\)--
Appciscounified_computing_system4.0\(4i\)--
Appciscounified_computing_system4.0\(4j\)--
Appciscounified_computing_system4.0\(4k\)--
Appciscounified_computing_system4.0\(4l\)--
Appciscounified_computing_system4.0\(4m\)--
Appciscounified_computing_system4.0\(4n\)--
Appciscounified_computing_system4.1\(1c\)--
Appciscounified_computing_system4.1\(1d\)--
Appciscounified_computing_system4.1\(1f\)--
Appciscounified_computing_system4.1\(1g\)--
Appciscounified_computing_system4.1\(1h\)--
Appciscounified_computing_system4.1\(2a\)--
Appciscounified_computing_system4.1\(2b\)--
Appciscounified_computing_system4.1\(2d\)--
Appciscounified_computing_system4.1\(2e\)--
Appciscounified_computing_system4.1\(2f\)--
Appciscounified_computing_system4.1\(2g\)--
Appciscounified_computing_system4.1\(2h\)--
Appciscounified_computing_system4.1\(2j\)--
Appciscounified_computing_system4.1\(2k\)--
Appciscounified_computing_system4.1\(2l\)--
Appciscounified_computing_system4.1\(2m\)--
Appciscounified_computing_system4.1\(3b\)--
Appciscounified_computing_system4.1\(3c\)--
Appciscounified_computing_system4.1\(3d\)--
Appciscounified_computing_system4.1\(3f\)--
Appciscounified_computing_system4.1\(3g\)--
Appciscounified_computing_system4.1\(3h\)--
Appciscounified_computing_system4.1\(3i\)--
Appciscounified_computing_system4.1\(3l\)--
Appciscounified_computing_system4.1\(3m\)--
Appciscounified_computing_system4.1\(3n\)--
Appciscounified_computing_system4.2\(1a\)--
Appciscounified_computing_system4.2\(1b\)--
Appciscounified_computing_system4.2\(1c\)--
Appciscounified_computing_system4.2\(1e\)--
Appciscounified_computing_system4.2\(1f\)--
Appciscounified_computing_system4.2\(1g\)--
Appciscounified_computing_system4.2\(1i\)--
Appciscounified_computing_system4.2\(1j\)--
Appciscounified_computing_system4.2\(2a\)--
Appciscounified_computing_system4.2\(2f\)--
Appciscounified_computing_system4.2\(2g\)--
Appciscounified_computing_system4.2\(3b\)--
Appciscounified_computing_system4.2\(3d\)--
Appciscounified_computing_system4.2\(3e\)--
Appciscounified_computing_system4.2\(3g\)--
Appciscounified_computing_system4.2\(3h\)--
Appciscounified_computing_system4.2\(3i\)--
Appciscounified_computing_system4.2\(3j\)--
Appciscounified_computing_system4.2\(3k\)--
Appciscounified_computing_system4.2\(3l\)--
Appciscounified_computing_system4.2\(3m\)--
Appciscounified_computing_system4.2\(3n\)--
Appciscounified_computing_system4.2\(3o\)--
Appciscounified_computing_system4.2\(3p\)--
Appciscounified_computing_system4.3\(1.230097\)--
Appciscounified_computing_system4.3\(1.230124\)--
Appciscounified_computing_system4.3\(1.230138\)--
Appciscounified_computing_system4.3\(2.230207\)--
Appciscounified_computing_system4.3\(2.230270\)--
Appciscounified_computing_system4.3\(2.240002\)--
Appciscounified_computing_system4.3\(2.240009\)--
Appciscounified_computing_system4.3\(2.240037\)--
Appciscounified_computing_system4.3\(2.240053\)--
Appciscounified_computing_system4.3\(2.240077\)--
Appciscounified_computing_system4.3\(2.240090\)--
Appciscounified_computing_system4.3\(2.240107\)--
Appciscounified_computing_system4.3\(2.250016\)--
Appciscounified_computing_system4.3\(2.250021\)--
Appciscounified_computing_system4.3\(2.250022\)--
Appciscounified_computing_system4.3\(2.250037\)--
Appciscounified_computing_system4.3\(2.250045\)--
Appciscounified_computing_system4.3\(2.250063\)--
Appciscounified_computing_system4.3\(3.240022\)--
Appciscounified_computing_system4.3\(3.240041\)--
Appciscounified_computing_system4.3\(3.240043\)--
Appciscounified_computing_system4.3\(4.240142\)--
Appciscounified_computing_system4.3\(4.240152\)--
Appciscounified_computing_system4.3\(4.241014\)--
Appciscounified_computing_system4.3\(4.241063\)--
Appciscounified_computing_system4.3\(4.242028\)--
Appciscounified_computing_system4.3\(4.242038\)--
Appciscounified_computing_system4.3\(4.242066\)--
Appciscounified_computing_system4.3\(4.252001\)--
Appciscounified_computing_system4.3\(4.252002\)--
Appciscounified_computing_system4.3\(5.240021\)--
Appciscounified_computing_system4.3\(5.250001\)--
Appciscounified_computing_system4.3\(5.250030\)--
Appciscounified_computing_system4.3\(5.250033\)--
Appciscounified_computing_system4.3\(5.250043\)--
Appciscounified_computing_system4.3\(5.250045\)--
Appciscounified_computing_system4.3\(6.250039\)--
Appciscounified_computing_system4.3\(6.250040\)--
Appciscounified_computing_system4.3\(6.250044\)--
Appciscounified_computing_system4.3\(6.250053\)--
Appciscounified_computing_system4.3\(6.250060\)--
Appciscounified_computing_system4.3\(6.250101\)--
Appciscounified_computing_system4.3\(6.250117\)--
Appciscounified_computing_system4.3\(6.260003\)--
Appciscounified_computing_system6.0\(1.250127\)--
Appciscounified_computing_system6.0\(1.250130\)--
Appciscounified_computing_system6.0\(1.250131\)--
Appciscounified_computing_system6.0\(1.250174\)--
Appciscounified_computing_system6.0\(1.250192\)--
Appciscounified_computing_system6.0\(1.250194\)--
OSciscounified_computing_system_e-series_software2.0.0--
OSciscounified_computing_system_e-series_software2.1.0--
OSciscounified_computing_system_e-series_software2.2.1--
OSciscounified_computing_system_e-series_software2.2.2--
OSciscounified_computing_system_e-series_software2.3.1--
OSciscounified_computing_system_e-series_software2.3.2--
OSciscounified_computing_system_e-series_software2.3.3--
OSciscounified_computing_system_e-series_software2.3.5--
OSciscounified_computing_system_e-series_software2.4.0--
OSciscounified_computing_system_e-series_software2.4.1--
OSciscounified_computing_system_e-series_software2.4.2--
OSciscounified_computing_system_e-series_software3.0.1--
OSciscounified_computing_system_e-series_software3.0.2--
OSciscounified_computing_system_e-series_software3.1.0--
OSciscounified_computing_system_e-series_software3.1.1--
OSciscounified_computing_system_e-series_software3.1.2--
OSciscounified_computing_system_e-series_software3.1.3--
OSciscounified_computing_system_e-series_software3.1.4--
OSciscounified_computing_system_e-series_software3.1.5--
OSciscounified_computing_system_e-series_software3.2.1--
OSciscounified_computing_system_e-series_software3.2.10--
OSciscounified_computing_system_e-series_software3.2.11.1--
OSciscounified_computing_system_e-series_software3.2.11.3--
OSciscounified_computing_system_e-series_software3.2.11.5--
OSciscounified_computing_system_e-series_software3.2.12.2--
OSciscounified_computing_system_e-series_software3.2.13.6--
OSciscounified_computing_system_e-series_software3.2.14--
OSciscounified_computing_system_e-series_software3.2.15--
OSciscounified_computing_system_e-series_software3.2.15.3--
OSciscounified_computing_system_e-series_software3.2.16.1--
OSciscounified_computing_system_e-series_software3.2.2--
OSciscounified_computing_system_e-series_software3.2.3--
OSciscounified_computing_system_e-series_software3.2.4--
OSciscounified_computing_system_e-series_software3.2.6--
OSciscounified_computing_system_e-series_software3.2.7--
OSciscounified_computing_system_e-series_software3.2.8--
OSciscounified_computing_system_e-series_software4.00--
OSciscounified_computing_system_e-series_software4.02--
OSciscounified_computing_system_e-series_software4.11.1--
OSciscounified_computing_system_e-series_software4.12.1--
OSciscounified_computing_system_e-series_software4.12.2--
OSciscounified_computing_system_e-series_software4.15.2--

Explore more

Back to dashboardcisco CVEsunified_computing_system vulnerabilities