EUVD-2026-72936
GHSA-xv95-6ccg-fmwj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local vector confirmed by boot-menu interaction requirement; PR:L for authenticated user/admin path; C:H/I:H for Secure Boot bypass enabling arbitrary pre-OS code execution; A:N since availability is unaffected.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software.
This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.
AnalysisAI
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin' role credentials - or unauthenticated attackers with physical device access - to disable Secure Boot protections and execute unauthorized software at boot time. The flaw stems from UEFI Shell memory-write commands remaining accessible while Secure Boot is active, enabling direct manipulation of Secure Boot validation variables in UEFI memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two discrete exploitation paths exist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Two distinct attack paths exist with different risk profiles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW) for the specific patched firmware/BIOS version applicable to each UCS platform and apply it promptly, as the fix presumably restricts memory-write shell commands while Secure Boot is active. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Cisco UCS Servers and UCS-based appliances in your environment, including current firmware versions and physical locations, and assess current physical security controls around these systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Same weakness CWE-749 – Exposed Dangerous Method or Function
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today