EUVD-2026-17947Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to password change endpoint
-
ExploitBypass authentication validation logic
-
ExecutionModify Admin user password
-
ImpactGain unauthenticated Admin access to IMC system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default installations of Cisco Integrated Management Controller (IMC). Attacker sends crafted HTTP request to change password functionality endpoint to bypass authentication and gain Admin access. |
| Impact | Real-world risk is exceptionally high based on converging threat signals. The CVSS 9.8 score reflects worst-case exploitability: network-accessible attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). An unauthenticated attacker can gain administrative access remotely without any preconditions, making this a perfect target for automated scanning and exploitation. The vulnerability affects infrastructure management components that typically have privileged access to entire compute environments, amplifying blast radius. While no public exploit identified at time of analysis and KEV status not confirmed, the trivial attack complexity and complete lack of authentication barriers suggest exploitation development would be straightforward for moderately skilled attackers. Organizations using affected Cisco UCS infrastructure should treat this as a top-priority remediation target, particularly for internet-facing or boundary-accessible management interfaces. The authentication bypass nature makes this attractive for initial access operations, ransomware deployment, and supply chain attacks targeting managed service providers. |
| Exploit ScenarioDerived | An attacker conducts network reconnaissance to identify Cisco UCS infrastructure with accessible IMC interfaces, typically on TCP ports 80 or 443. Without any credentials, the attacker crafts a malicious HTTP POST request exploiting the password change functionality's input validation flaw, targeting the Admin account. The vulnerable IMC accepts the unauthorized password modification request, allowing the attacker to set a new password for the administrative user. The attacker then authenticates with the newly set credentials, gaining full administrative access to the IMC interface and underlying UCS infrastructure, enabling server configuration changes, firmware manipulation, virtual machine management, and potential lateral movement to managed compute resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Authentication bypass in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to gain administrative access by exploiting improper password change request handling. Affected products include Cisco Enterprise NFV Infrastructure Software, Unified Computing System (Standalone), and UCS E-Series Software. The attacker can alter any user's password, including Admin accounts, and take full control of the management interface. CVSS 9.8 (Critical) with network-accessible attack vector requiring no privileges or user interaction. No public exploit identified at time of analysis, though EPSS data not available for comprehensive risk assessment.
RemediationAI
Organizations should immediately consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn for vendor-recommended remediation steps and patched software versions. As an immediate risk mitigation measure, restrict network access to Cisco IMC interfaces using firewall rules or access control lists, allowing connections only from trusted management networks or jump hosts. Disable external or internet-facing access to IMC interfaces entirely if not operationally required. Implement network segmentation to isolate management plane traffic from production networks. Monitor IMC access logs for unauthorized password change attempts or suspicious authentication activity. Enable multi-factor authentication if supported in patched versions. Given the unauthenticated nature of the exploit, network-layer controls are critical until patches can be deployed. Organizations should prioritize patching based on exposure risk, addressing internet-accessible or DMZ-located UCS infrastructure first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Integrated Management Controller provides out-of-band management for Cisco UCS servers and network function virtualization infrastructure. This vulnerability stems from CWE-20 (Improper Input Validation) in the password change functionality, where the application fails to properly validate or authenticate password modification requests. The affected CPE entries indicate impact across multiple Cisco UCS product lines: Enterprise NFV Infrastructure Software, Unified Computing System Standalone configurations, and UCS E-Series deployments. The flaw allows manipulation of the password change mechanism through crafted HTTP requests, bypassing the authentication layer entirely. This represents a critical failure in identity and access management controls at the hardware management layer, where IMC typically operates with privileged access to physical and virtual infrastructure components.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin.
This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.
Articles & Coverage 1
Executive ViewAI
Cisco Integrated Management Controller (IMC) contains a critical unauthenticated authentication bypass vulnerability (CVSS 9.8) affecting Enterprise NFV Infrastructure, Unified Computing System (Standalone), and UCS E-Series products, enabling attackers to reset administrative passwords and seize complete control of infrastructure management interfaces. This vulnerability directly threatens organizational infrastructure availability and security, as any networked attacker can assume administrative privileges without credentials, gaining access to critical compute and networking management functions.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Cisco IMC management interfaces to dedicated administrative networks only using firewall ACLs; (2) Disable remote management access if operationally feasible; (3) Enforce network segmentation isolating management VLANs; (4) Implement intrusion detection rules for suspicious password change requests to IMC; (5) Monitor IMC audit logs for unauthorized administrative activities; (6) Require VPN or jump-host access for all IMC management connections; (7) Enable all available logging and alerting on the IMC platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB