CVE-2026-20094

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Configurations

No configuration.

History

01 Apr 2026, 17:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-01 17:28

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20094

Mitre link : CVE-2026-20094

CVE.ORG link : CVE-2026-20094

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-20094", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20094", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Unified Computing System (Standalone)", "versions": [{"status": "affected", "version": "4.0(2g)"}, {"status": "affected", "version": "3.1(2i)"}, {"status": "affected", "version": "3.1(1d)"}, {"status": "affected", "version": "4.0(4i)"}, {"status": "affected", "version": "4.1(1c)"}, {"status": "affected", "version": "4.0(2c)"}, {"status": "affected", "version": "4.0(1e)"}, {"status": "affected", "version": "4.0(2h)"}, {"status": "affected", "version": "4.0(4h)"}, {"status": "affected", "version": "4.0(1h)"}, {"status": "affected", "version": "4.0(2l)"}, {"status": "affected", "version": "3.1(3g)"}, {"status": "affected", "version": "4.0(1.240)"}, {"status": "affected", "version": "4.0(2f)"}, {"status": "affected", "version": "4.0(1g)"}, {"status": "affected", "version": "4.0(2i)"}, {"status": "affected", "version": "3.1(3i)"}, {"status": "affected", "version": "4.0(4d)"}, {"status": "affected", "version": "4.1(1d)"}, {"status": "affected", "version": "3.1(3c)"}, {"status": "affected", "version": "4.0(4k)"}, {"status": "affected", "version": "3.1(2d)"}, {"status": "affected", "version": "3.1(3a)"}, {"status": "affected", "version": "3.1(3j)"}, {"status": "affected", "version": "4.0(2d)"}, {"status": "affected", "version": "4.1(1f)"}, {"status": "affected", "version": "4.0(4j)"}, {"status": "affected", "version": "4.0(2m)"}, {"status": "affected", "version": "4.0(2k)"}, {"status": "affected", "version": "4.0(1c)"}, {"status": "affected", "version": "4.0(4f)"}, {"status": "affected", "version": "4.0(4c)"}, {"status": "affected", "version": "3.1(3d)"}, {"status": "affected", "version": "3.1(2g)"}, {"status": "affected", "version": "3.1(2c)"}, {"status": "affected", "version": "4.0(1d)"}, {"status": "affected", "version": "3.1(2e)"}, {"status": "affected", "version": "4.0(1a)"}, {"status": "affected", "version": "4.0(1b)"}, {"status": "affected", "version": "3.1(3b)"}, {"status": "affected", "version": "4.0(4b)"}, {"status": "affected", "version": "3.1(2b)"}, {"status": "affected", "version": "4.0(4e)"}, {"status": "affected", "version": "3.1(3h)"}, {"status": "affected", "version": "4.0(4l)"}, {"status": "affected", "version": "4.1(1g)"}, {"status": "affected", "version": "4.1(2a)"}, {"status": "affected", "version": "4.0(2n)"}, {"status": "affected", "version": "4.1(1h)"}, {"status": "affected", "version": "3.1(3k)"}, {"status": "affected", "version": "4.1(2b)"}, {"status": "affected", "version": "4.0(2o)"}, {"status": "affected", "version": "4.0(4m)"}, {"status": "affected", "version": "4.1(2d)"}, {"status": "affected", "version": "4.1(3b)"}, {"status": "affected", "version": "4.0(2p)"}, {"status": "affected", "version": "4.1(2e)"}, {"status": "affected", "version": "4.1(2f)"}, {"status": "affected", "version": "4.0(4n)"}, {"status": "affected", "version": "4.0(2q)"}, {"status": "affected", "version": "4.1(3c)"}, {"status": "affected", "version": "4.0(2r)"}, {"status": "affected", "version": "4.1(3d)"}, {"status": "affected", "version": "4.1(2g)"}, {"status": "affected", "version": "4.1(2h)"}, {"status": "affected", "version": "4.1(3g)"}, {"status": "affected", "version": "4.1(3f)"}, {"status": "affected", "version": "4.1(2j)"}, {"status": "affected", "version": "4.1(2k)"}, {"status": "affected", "version": "4.1(3h)"}, {"status": "affected", "version": "4.2(2a)"}, {"status": "affected", "version": "4.1(3i)"}, {"status": "affected", "version": "4.2(2f)"}, {"status": "affected", "version": "4.2(2g)"}, {"status": "affected", "version": "4.2(3b)"}, {"status": "affected", "version": "4.1(3l)"}, {"status": "affected", "version": "4.2(3d)"}, {"status": "affected", "version": "4.3(1.230097)"}, {"status": "affected", "version": "4.2(1e)"}, {"status": "affected", "version": "4.2(1b)"}, {"status": "affected", "version": "4.2(1j)"}, {"status": "affected", "version": "4.2(1i)"}, {"status": "affected", "version": "4.2(1f)"}, {"status": "affected", "version": "4.2(1a)"}, {"status": "affected", "version": "4.2(1c)"}, {"status": "affected", "version": "4.2(1g)"}, {"status": "affected", "version": "4.3(1.230124)"}, {"status": "affected", "version": "4.1(2l)"}, {"status": "affected", "version": "4.2(3e)"}, {"status": "affected", "version": "4.3(1.230138)"}, {"status": "affected", "version": "4.2(3g)"}, {"status": "affected", "version": "4.3(2.230207)"}, {"status": "affected", "version": "4.2(3h)"}, {"status": "affected", "version": "4.2(3i)"}, {"status": "affected", "version": "4.3(2.230270)"}, {"status": "affected", "version": "4.1(3m)"}, {"status": "affected", "version": "4.1(2m)"}, {"status": "affected", "version": "4.3(2.240002)"}, {"status": "affected", "version": "4.3(3.240022)"}, {"status": "affected", "version": "4.2(3j)"}, {"status": "affected", "version": "4.1(3n)"}, {"status": "affected", "version": "4.3(2.240009)"}, {"status": "affected", "version": "4.3(3.240041)"}, {"status": "affected", "version": "4.2(3k)"}, {"status": "affected", "version": "4.3(3.240043)"}, {"status": "affected", "version": "4.3(4.240142)"}, {"status": "affected", "version": "4.3(2.240037)"}, {"status": "affected", "version": "4.3(2.240053)"}, {"status": "affected", "version": "4.3(4.240152)"}, {"status": "affected", "version": "4.2(3l)"}, {"status": "affected", "version": "4.3(2.240077)"}, {"status": "affected", "version": "4.3(4.242028)"}, {"status": "affected", "version": "4.3(4.241063)"}, {"status": "affected", "version": "4.3(4.242038)"}, {"status": "affected", "version": "4.2(3m)"}, {"status": "affected", "version": "4.3(2.240090)"}, {"status": "affected", "version": "4.3(5.240021)"}, {"status": "affected", "version": "4.3(2.240107)"}, {"status": "affected", "version": "4.3(4.242066)"}, {"status": "affected", "version": "4.2(3n)"}, {"status": "affected", "version": "4.3(5.250001)"}, {"status": "affected", "version": "4.2(3o)"}, {"status": "affected", "version": "4.3(2.250016)"}, {"status": "affected", "version": "4.3(2.250021)"}, {"status": "affected", "version": "4.3(5.250030)"}, {"status": "affected", "version": "4.3(2.250022)"}, {"status": "affected", "version": "4.3(6.250039)"}, {"status": "affected", "version": "4.3(6.250040)"}, {"status": "affected", "version": "4.3(5.250033)"}, {"status": "affected", "version": "4.3(6.250044)"}, {"status": "affected", "version": "4.3(6.250053)"}, {"status": "affected", "version": "4.3(2.250037)"}, {"status": "affected", "version": "4.3(2.250045)"}, {"status": "affected", "version": "4.3(4.252001)"}, {"status": "affected", "version": "4.3(4.252002)"}, {"status": "affected", "version": "6.0(1.250127)"}, {"status": "affected", "version": "4.2(3p)"}, {"status": "affected", "version": "6.0(1.250131)"}, {"status": "affected", "version": "4.3(6.250101)"}, {"status": "affected", "version": "6.0(1.250174)"}, {"status": "affected", "version": "4.3(6.250117)"}, {"status": "affected", "version": "4.3(5.250043)"}, {"status": "affected", "version": "4.3(5.250045)"}, {"status": "affected", "version": "4.3(6.250060)"}, {"status": "affected", "version": "6.0(1.250130)"}, {"status": "affected", "version": "4.3(4.241014)"}, {"status": "affected", "version": "4.3(2.250063)"}, {"status": "affected", "version": "6.0(1.250192)"}, {"status": "affected", "version": "4.3(6.260003)"}, {"status": "affected", "version": "6.0(1.250194)"}], "defaultStatus": "unknown"}, {"vendor": "Cisco", "product": "Cisco Unified Computing System E-Series Software (UCSE)", "versions": [{"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.11.1"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.1.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "3.1.2"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "2.3.2"}, {"status": "affected", "version": "2.3.5"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "3.1.4"}, {"status": "affected", "version": "2.4.1"}, {"status": "affected", "version": "2.3.1"}, {"status": "affected", "version": "3.1.3"}, {"status": "affected", "version": "2.3.3"}, {"status": "affected", "version": "2.4.2"}, {"status": "affected", "version": "3.1.5"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "3.2.11.3"}, {"status": "affected", "version": "3.2.11.5"}, {"status": "affected", "version": "3.2.12.2"}, {"status": "affected", "version": "3.2.13.6"}, {"status": "affected", "version": "3.2.14"}, {"status": "affected", "version": "4.11.1"}, {"status": "affected", "version": "3.2.15"}, {"status": "affected", "version": "4.12.1"}, {"status": "affected", "version": "3.2.15.3"}, {"status": "affected", "version": "4.12.2"}, {"status": "affected", "version": "3.2.16.1"}, {"status": "affected", "version": "4.00"}, {"status": "affected", "version": "4.15.2"}, {"status": "affected", "version": "4.02"}], "defaultStatus": "unknown"}]}], "published": "2026-04-01T17:28:29.230", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user.\r\n\r\nThis vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user."}], "lastModified": "2026-06-17T10:17:04.857", "sourceIdentifier": "psirt@cisco.com"}