CVE-2026-20288: Cisco Integrated Management Controller argument injection in web interface

CVE-2026-20288 · Severity: medium · CVSS 6.5 · Published 2026-08-05

Cisco's Integrated Management Controller (IMC) is a web-based management interface for server hardware that allows administrators to remotely monitor and configure systems. An authenticated attacker with administrative privileges can inject arbitrary commands through crafted web interface inputs, leading to remote code execution and privilege escalation to root. This undermines the security of critical infrastructure including data center servers, edge appliances, and enterprise network systems.

Technologies: Cisco Catalyst 8300 Series Edge uCPE, Cisco UCS S-Series Storage Servers. Vendors: Cisco.

Quick answers

Is CVE-2026-20288 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20288 being exploited in the wild.
How severe is CVE-2026-20288?
Medium severity, with a CVSS score of 6.5, published 5 August 2026.
Which products and versions are affected?
Cisco 5000 Series Enterprise Network Compute Systems (ENCS); Cisco Catalyst 8300 Series Edge uCPE; Cisco UCS C-Series M5 and M6 Rack Servers; Cisco UCS C-Series M7 and M8 Rack Servers; and 14 more.
Is there a fix for CVE-2026-20288?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20288 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20288?
Check whether you run Cisco 5000 Series Enterprise Network Compute Systems (ENCS), Cisco Application Policy Infrastructure Controller (APIC) Servers, Cisco Business Edition 6000 and 7000 Appliances or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an argument injection vulnerability (CWE-141, CWE-146) in the web-based management interface of Cisco IMC due to improper validation of user-supplied input. An authenticated, remote attacker with Admin privileges can enter crafted inputs to the web interface to execute arbitrary commands on the underlying operating system as the root user. The vulnerability is network-accessible and requires valid admin credentials but no user interaction. Successful exploitation allows complete system compromise including data access, integrity violation, and service disruption. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

  • Cisco 5000 Series Enterprise Network Compute Systems (ENCS)
  • Cisco Catalyst 8300 Series Edge uCPE
  • Cisco UCS C-Series M5 and M6 Rack Servers
  • Cisco UCS C-Series M7 and M8 Rack Servers
  • Cisco UCS E-Series Servers M3
  • Cisco UCS E-Series Servers M6
  • Cisco UCS S-Series Storage Servers
  • Cisco Application Policy Infrastructure Controller (APIC) Servers
  • Cisco Business Edition 6000 and 7000 Appliances
  • Cisco Catalyst Center Appliances
  • Cisco Telemetry Broker Appliances
  • Cisco Cloud Services Platform (CSP) 5000 Series
  • Cisco Cyber Vision Center Appliances
  • Cisco HyperFlex Edge Nodes
  • Cisco HyperFlex Nodes
  • Cisco Nexus Dashboard Appliances
  • Cisco Secure Firewall Management Center (FMC) Appliances
  • Cisco IOS XRv 9000 Appliances

Timeline

  • 2026-08-05: disclosed
  • 2026-08-05: advisory: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.