CVE-2026-20200: Cisco IMC argument injection in web management interface

CVE-2026-20200 · Severity: high · CVSS 8.8 · Published 2026-08-05

Cisco Integrated Management Controller (IMC) is a web-based management interface used to remotely manage Cisco servers and related appliances. An authenticated attacker with low privileges could exploit improper input validation to execute arbitrary commands as the root user, gaining full control of the underlying system. This affects many enterprise server and appliance models across Cisco's product portfolio.

Technologies: Cisco Catalyst 8300 Series Edge uCPE, Cisco Secure Firewall Management Center (FMC), Cisco UCS S-Series Storage Servers. Vendors: Cisco.

Quick answers

Is CVE-2026-20200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20200 being exploited in the wild.
How severe is CVE-2026-20200?
High severity, with a CVSS score of 8.8, published 5 August 2026.
Which products and versions are affected?
Cisco 5000 Series Enterprise Network Compute Systems See vendor advisory for specific vulnerable releases; Cisco Application Policy Infrastructure Controller (APIC) See vendor advisory for specific vulnerable releases; Cisco Catalyst 8300 Series Edge uCPE See vendor advisory for specific vulnerable releases; Cisco Catalyst Center Appliances See vendor advisory for specific vulnerable releases; and 6 more.
Is there a fix for CVE-2026-20200?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20200 attacked?
It is attacked over the network.
Am I affected by CVE-2026-20200?
Check whether you run Cisco 5000 Series Enterprise Network Compute Systems, Cisco Application Policy Infrastructure Controller (APIC), Cisco Catalyst 8300 Series Edge uCPE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an argument injection flaw (CWE-141/CWE-146) in the IMC web-based management interface caused by improper validation of user-supplied input. An authenticated remote attacker with low privileges can exploit this by submitting crafted input through the web interface to execute arbitrary operating system commands with root privileges. No user interaction is required beyond initial authentication, and the attack is network-reachable. Cisco has released software updates to address the vulnerability; no workarounds are available.

Affected products

  • Cisco UCS C-Series M7 and M8 Rack Servers See vendor advisory for specific vulnerable releases
  • Cisco UCS C-Series M5 and M6 Rack Servers See vendor advisory for specific vulnerable releases
  • Cisco Catalyst 8300 Series Edge uCPE See vendor advisory for specific vulnerable releases
  • Cisco 5000 Series Enterprise Network Compute Systems See vendor advisory for specific vulnerable releases
  • Cisco UCS E-Series Servers M3 See vendor advisory for specific vulnerable releases
  • Cisco UCS E-Series Servers M6 See vendor advisory for specific vulnerable releases
  • Cisco UCS S-Series Storage Servers See vendor advisory for specific vulnerable releases
  • Cisco Application Policy Infrastructure Controller (APIC) See vendor advisory for specific vulnerable releases
  • Cisco Catalyst Center Appliances See vendor advisory for specific vulnerable releases
  • Cisco Secure Firewall Management Center (FMC) See vendor advisory for specific vulnerable releases

Timeline

  • 2026-08-05: disclosed: Vulnerability publicly disclosed
  • 2026-08-05: advisory: Cisco Security Advisory cisco-sa-cimc-arg-inject-upSHdMfU published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.