Skip to content
VulniPulse
Sign in
Medium4.4Cisco

Medium [CVE-2026-20037] Cisco UCS Manager Software Privilege Escalation Vulnerability

This medium-severity Cisco advisory covers CVE-2026-20037 affecting Cisco Unified Computing System (Managed), NX-OS, UCS.

cisco-sa-ucsm-afwae-mOgUfyLn Published Feb 25, 2026Updated by vendor Feb 25, 2026
CVE-2026-20037
Affected products & platforms
CiscoSwitchesNexusNX-OS
Open vendor advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system. This vulnerability exists because unnecessary privileges are given to the user.

An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI. A successful exploit could allow the attacker to create or overwrite files in the file system or perform limited privileged actions on an affected device.

Cisco has r…

Affected products named by the advisory: Cisco Unified Computing System (Managed).

Affected versions
  • Scope: At the time of publication, this vulnerability affected the following Cisco products if they were running a vulnerable release of Cisco UCS Manager Software, regardless of device configuration:
  • 4.1 and earlier — Migrate to a fixed release
  • 4.2 — Migrate to a fixed release
  • Release 4.3 (first fixed: 4.3(6f))

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • 4.3(6f)

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release 4.1 and earlier: migrate to a fixed release.
  • Release 4.2: migrate to a fixed release.
  • Release 4.3: upgrade to 4.3(6f).
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.