CVE-2026-20093— Cisco Integrated Management Controller Authentication Bypass Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20093
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Integrated Management Controller Authentication Bypass Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Integrated Management Controller 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Integrated Management Controller（IMC）是美国思科（Cisco）公司的一套用于对UCS（统一计算系统）进行管理的软件。该软件支持HTTP、SSH访问等，并可对服务器进行开机、关机和重启等操作。 Cisco Integrated Management Controller存在输入验证错误漏洞，该漏洞源于密码更改请求处理不当，可能导致未经验证的远程攻击者绕过身份验证并获取管理员权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Enterprise NFV Infrastructure Software | 4.1.1 | - | |
| Cisco | Cisco Unified Computing System (Standalone) | 4.0(2g) | - | |
| Cisco | Cisco Unified Computing System E-Series Software (UCSE) | 3.2.7 | - |
II. Public POCs for CVE-2026-20093
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20093
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2026-04-01 · 16 CVEs total
| CVE-2026-20160 | 9.8 CRITICAL | Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability |
| CVE-2026-20094 | 8.8 HIGH | Cisco Integrated Management Controller Command Injection Vulnerability |
| CVE-2026-20155 | 8.0 HIGH | Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability |
| CVE-2026-20151 | 7.3 HIGH | Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability |
| CVE-2026-20096 | 6.5 MEDIUM | Cisco Integrated Management Controller Command Injection Vulnerability |
| CVE-2026-20097 | 6.5 MEDIUM | Cisco Integrated Management Controller Remote Code Execution Vulnerability |
| CVE-2026-20095 | 6.5 MEDIUM | Cisco Integrated Management Controller Command Injection Vulnerability |
| CVE-2026-20042 | 6.5 MEDIUM | Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability |
| CVE-2026-20085 | 6.1 MEDIUM | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
| CVE-2026-20041 | 6.1 MEDIUM | Cisco Nexus Dashboard Server Side Request Forgery Vulnerability |
| CVE-2026-20174 | 4.9 MEDIUM | Cisco Nexus Dashboard Insights Arbitrary File Write Vulnerability |
| CVE-2026-20090 | 4.8 MEDIUM | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
| CVE-2026-20089 | 4.8 MEDIUM | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
| CVE-2026-20087 | 4.8 MEDIUM | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
| CVE-2026-20088 | 4.8 MEDIUM | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Enterprise NFV Infrastructure Software
- CVE-2026-20090
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20089
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20087
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20088
Cisco Integrated Management Controller Cross-Site Scripting - CVE-2026-20096
Cisco Integrated Management Controller Command Injection Vul
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-20
V. Comments for CVE-2026-20093
No comments yet