EUVD-2026-17948Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with read-only credentials
-
ExploitSend crafted command to web interface
-
ExecutionBypass input validation
-
ImpactExecute arbitrary commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to Cisco IMC web-based management interface with read-only or higher privileges. Attacker must send crafted commands via the management interface. No victim interaction needed. Affects Cisco IMC (version not specified in description). |
| Impact | Real-world risk is HIGH despite requiring low-privilege authentication. The CVSS 8.8 score accurately reflects critical impact: network-based attack vector (AV:N), low complexity (AC:L), and complete system compromise (C:H/I:H/A:H). The privilege escalation from read-only to root represents a significant security boundary violation. Cisco management interfaces are frequently exposed to corporate networks and sometimes inadvertently to the internet, increasing attack surface. The low-privilege requirement (PR:L) means any authenticated user-including those with monitoring-only accounts-can gain full administrative control. SSVC factors suggest elevated priority: technical impact is total (root access), and network accessibility makes this automatable if credentials are compromised through phishing, credential stuffing, or initial access. No KEV listing or public POC moderates immediate urgency, but organizations with exposed Cisco IMC instances should prioritize patching given the authentication-to-root privilege escalation path. |
| Exploit ScenarioDerived | An attacker compromises read-only credentials for a Cisco IMC web interface through phishing or password reuse from external breaches. Authenticating to the management portal, they identify vulnerable input fields in monitoring or reporting functions. The attacker crafts HTTP requests containing shell metacharacters and malicious commands-for example, injecting backticks or semicolons into device query parameters that are passed unsanitized to underlying system calls. Upon submission, the IMC executes the injected commands with root privileges, allowing the attacker to create persistent backdoors, extract sensitive configuration data including stored credentials, pivot to managed UCS servers, or disrupt infrastructure availability by modifying firmware or shutting down managed systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Command injection in Cisco Integrated Management Controller (IMC) web interface allows authenticated attackers with read-only privileges to execute arbitrary commands as root. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only low-privilege authentication, with no public exploit identified at time of analysis. EPSS data not provided; CVE-2026 prefix suggests future disclosure.
RemediationAI
Consult the official Cisco Security Advisory cisco-sa-cimc-cmd-inj-3hKN3bVt at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt for vendor-confirmed patched software versions and upgrade instructions. Patch availability and specific remediated versions are detailed in the advisory but not independently confirmed in provided intelligence data. As interim mitigations, restrict network access to the Cisco IMC web interface using firewall rules or VPNs to limit exposure to trusted management networks, implement strict role-based access controls to minimize accounts with even read-only privileges, and monitor authentication logs for unusual activity from low-privilege accounts accessing administrative functions. Organizations should prioritize upgrades for internet-facing or broadly accessible IMC instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Integrated Management Controller (IMC) provides out-of-band management for Cisco UCS standalone servers and E-series infrastructure. This CWE-77 command injection vulnerability stems from improper input validation in the web-based management interface, allowing attackers to inject shell metacharacters or commands into parameters processed by the underlying operating system. The affected CPE strings identify Cisco Unified Computing System (Standalone) and UCS E-Series Software (UCSE) products. Command injection flaws typically occur when application code passes unsanitized user input directly to system shells via functions like exec(), system(), or popen(), enabling attackers to break out of intended command contexts and execute arbitrary code with the privileges of the web service-in this case, root-level access.
Know when Cisco Unified Computing System Standalone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Executive ViewAI
CVE-2026-20094 is a high-severity command injection vulnerability in Cisco Integrated Management Controller (IMC) that allows authenticated users with read-only access to execute arbitrary commands with root privileges across the network. This directly threatens infrastructure management security, as attackers with basic system access can escalate to complete control of physical and virtual infrastructure managed through IMC.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict IMC web interface access via network firewall to authorized administrative networks only; (2) Enforce multi-factor authentication on IMC accounts where supported; (3) Implement command logging and behavioral monitoring on all IMC web interface traffic; (4) Disable read-only user accounts not actively required; (5) Monitor IMC audit logs for suspicious command execution patterns; (6) Consider temporary transition of critical infrastructure monitoring to alternative out-of-band management channels until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacke
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Privilege escalation via command injection in Cisco Integrated Management Controller (IMC) allows authenticated Admin-le
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Cisco IMC web-based management interface allows authenticated administrators to execute arbitrary code as root through i
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
GitHub PoC
Exploit-DB