EUVD-2026-72936
GHSA-xv95-6ccg-fmwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess UCS console or CIMC KVM
-
DeliveryTrigger or wait for server reboot
-
ExploitSelect UEFI Shell at boot menu
-
ExecutionIssue memory-write shell commands
-
PersistOverwrite Secure Boot EFI variables
-
ImpactBoot unauthorized/unsigned software
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Two discrete exploitation paths exist. Authenticated path: attacker must possess valid credentials for a UCS account with the 'user' or 'admin' role AND have access to the server console or out-of-band management interface (CIMC/KVM) during a reboot window; this is not a network-exploitable vulnerability against running systems - a reboot and boot-menu interaction are required. Physical access path: unauthenticated attacker requires unescorted physical access to the server chassis during power-on/boot (selecting UEFI Shell from the boot menu), with no credentials required. Limiting factors for the authenticated path include: management plane must be reachable, a reboot must occur or be induced, and the attacker must interact at the boot menu - remote silent exploitation is not possible. Limiting factors for the physical path: physical datacenter access is gated by physical security controls. UEFI Shell must be enabled as a boot option (default on most UEFI systems unless explicitly disabled). |
| Impact | Two distinct attack paths exist with different risk profiles. The authenticated local path (represented by the vendor CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 7.1) requires only a low-privilege 'user' account plus the ability to reach the server console or out-of-band management (CIMC/KVM) at boot time - a meaningful but bounded privilege bar in datacenter environments. The unauthenticated physical-access path requires no credentials at all, only momentary physical proximity at boot; this path is more accurately represented by AV:P/PR:N, yielding a lower absolute CVSS score but a qualitatively different threat (insider threat, supply-chain, or datacenter-access scenarios). EPSS data is not provided, and there is no KEV listing or known public exploit code, suggesting exploitation is not currently widespread. The C:H/I:H rating is justified: compromising Secure Boot integrity enables persistent, pre-OS firmware implants that survive OS reinstalls. The A:N rating is consistent - the exploit executes software rather than denying availability. Real-world risk is moderate-to-high for environments where Secure Boot is a key compliance or zero-trust control (e.g., FedRAMP, DISA STIG, financial sector), but lower for organizations without strict firmware integrity requirements. The dual-vector nature (physical vs. authenticated remote console) means risk is context-dependent: remote-only exposure requires UCS management plane compromise first. |
| Exploit ScenarioDerived | An attacker with a low-privilege CIMC account (or physical console access during a maintenance window) selects 'UEFI Shell' from the boot menu during server reboot, then issues EFI variable write commands (e.g., via the UEFI Shell 'setvar' utility) to clear or replace the Secure Boot key database entries, disabling signature enforcement. On the next boot, the attacker loads a custom, unsigned bootloader or kernel implant that persists below the OS level and survives future OS reinstalls. No exploit code has been publicly identified, but the technique is well-documented in UEFI security research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. A successful exploit undermines firmware integrity controls, potentially allowing persistent pre-OS implants or untrusted bootloaders on enterprise server infrastructure. No public exploit code or CISA KEV entry has been identified at time of analysis.
RemediationAI
Consult the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW) for the specific patched firmware/BIOS version applicable to each UCS platform and apply it promptly, as the fix presumably restricts memory-write shell commands while Secure Boot is active. As an immediate workaround where patching is not possible: disable the UEFI Shell boot option in BIOS/UEFI configuration to prevent selection at boot time - note this removes a firmware-level diagnostic tool that some operations teams rely on. Restrict physical access to affected servers and enforce datacenter badge controls to eliminate the unauthenticated physical-access path. Restrict UCS management-plane access (CIMC, UCS Manager) to authorized personnel and enforce MFA on management accounts to raise the bar for the authenticated path. Enable out-of-band management audit logging to detect unauthorized UEFI Shell sessions. If Secure Boot compliance is a regulatory requirement, treat this as a P1 patch until remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the UEFI Shell - an interactive firmware environment included in UEFI-compliant systems - present across Cisco Unified Computing System (UCS) Managed, Standalone, E-Series (UCSE), and Enterprise NFV Infrastructure Software (ENFI) platforms (CPE: cpe:2.3:a:cisco:cisco_unified_computing_system_(managed):*, cpe:2.3:a:cisco:cisco_unified_computing_system_(standalone):*, cpe:2.3:a:cisco:cisco_unified_computing_system_e-series_software_(ucse):*, cpe:2.3:a:cisco:cisco_enterprise_nfv_infrastructure_software:*). CWE-749 (Exposed Dangerous Method or Function) is the root cause: Cisco's UEFI implementation exposes privileged shell commands - specifically memory-variable write operations (e.g., 'setvar') - in an interactive shell that remains selectable as a boot option even when UEFI Secure Boot is enabled. An attacker selecting the UEFI Shell at the boot menu can overwrite NVRAM-backed EFI variables that govern Secure Boot state (such as PK, KEK, db, or dbx entries), effectively disabling or circumventing signature validation of subsequent boot payloads.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local vector confirmed by boot-menu interaction requirement; PR:L for authenticated user/admin path; C:H/I:H for Secure Boot bypass enabling arbitrary pre-OS code execution; A:N since availability is unaffected.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software.
This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.
Executive ViewAI
Cisco UCS Servers and UCS-based appliances contain a Secure Boot bypass allowing privileged internal users or physical attackers to disable firmware security controls and install persistent malware at the hardware level. This vulnerability threatens enterprise server infrastructure by enabling firmware-level compromise that persists across operating system reinstallation and security patches. No public exploit identified at time of analysis; however, with no vendor patch currently available, remediation must focus on restricting access and detecting unauthorized firmware modifications.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforce strict physical security and access controls around UCS servers and consoles; minimize and audit all user and admin credentials with server access; disable UEFI Shell functionality where operationally safe; enable and continuously monitor BIOS/UEFI firmware event logs for unauthorized changes; implement firmware integrity checking at boot time; restrict physical access to UEFI configuration menus without multi-factor approval; establish out-of-band monitoring for any firmware modifications; prepare an isolated test environment for validating patches once Cisco releases updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to gain ad
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB