High [CVE-2026-20094 +3] Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities
This high-severity Cisco advisory covers CVE-2026-20094 and CVE-2026-20095 and 2 more CVEs affecting Unified Computing System (Standalone), Unified Computing System E-Series Software (UCSE), Enterprise NFV Infrastructure Software.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to execute arbitrary code or commands on the underlying operating system of an affected system and elevate privileges to root.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Affected products named by the advisory: Unified Computing System (Standalone); Unified Computing System E-Series Software (UCSE); Enterprise NFV Infrastructure Software.
- Scope: These vulnerabilities affect the following Cisco products if they are running a vulnerable release of Cisco IMC, regardless of device configuration: Product CVE IDs Cisco Bug IDs 5000 Series Enterprise Network Compute Systems (ENCS) CVE-2026-20095
- Release 4.15 and earlier (first fixed: 4.15.5)
- 4.16 and earlier — Migrate to a fixed release
- Release 4.18 (first fixed: 4.18.3 (Apr 2026))
- 4.2 and earlier — Migrate to a fixed release
- Release 4.3 (first fixed: 4.3(2.260007))
- 4.2 and earlier — Migrate to a fixed release
- Release 4.3 (first fixed: 4.3(6.260017))
- Release 6.0 (first fixed: 6.0(2.260044))
- Release 3.2 and earlier (first fixed: 3.2.17)
- Release 4.15 and earlier (first fixed: 4.15.3)
- 4.2 and earlier — Migrate to a fixed release
- Release 4.3 (first fixed: 4.3(6.260017))
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 4.15.5
- 4.18.3 (Apr 2026)
- 4.3(2.260007)
- 4.3(6.260017)
- 6.0(2.260044)
- 3.2.17
- 4.15.3
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release 4.15 and earlier: upgrade to 4.15.5.
- Release 4.16 and earlier: migrate to a fixed release.
- Release 4.18: upgrade to 4.18.3 (Apr 2026).
- Release 4.2 and earlier: migrate to a fixed release.
- Release 4.3: upgrade to 4.3(2.260007).
- Release 4.2 and earlier: migrate to a fixed release.
- Release 4.3: upgrade to 4.3(6.260017).
- Release 6.0: upgrade to 6.0(2.260044).
- There are no workarounds that address these vulnerabilities.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.