Vulnerability · Published Apr 1, 2026 · Assigned by cisco
CVE-2026-20094Cisco Integrated Management Controller Command Injection Vulnerability
High 8.8
In plain English
A high-severity command injection in Cisco Unified Computing System E-Series Software (UCSE) from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Official description
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Unified Computing System (Standalone) | 4.0(2g)3.1(2i)3.1(1d)4.0(4i)4.1(1c)4.0(2c)4.0(1e)4.0(2h) |
| Cisco | Cisco Unified Computing System E-Series Software (UCSE) | 3.2.73.2.63.2.43.2.103.2.23.2.32.4.03.2.1 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H