CVE-2026-20293: Cisco UCS UEFI Shell Secure Boot bypass

CVE-2026-20293 · Severity: high · CVSS 7.1 · Published 2026-09-08

Cisco UCS Servers and UCS-based appliances contain a vulnerability in their UEFI firmware shell that allows attackers to bypass Secure Boot protections and execute unauthorized code during boot. An attacker with physical access to a device's keyboard/video console, or with valid user/admin credentials, can use shell commands to modify firmware memory and disable security checks, potentially installing malicious software that persists across reboots.

Technologies: Cisco Nexus Dashboard, Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, Cisco Secure Firewall Management Center, Cisco UCS S-Series Storage Servers. Vendors: Cisco.

Quick answers

Is CVE-2026-20293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20293 being exploited in the wild.
How severe is CVE-2026-20293?
High severity, with a CVSS score of 7.1, published 8 September 2026.
Which products and versions are affected?
Cisco UCS B-Series Blade Servers; Cisco UCS C-Series Rack Servers; Cisco UCS C845A M8 Rack Server; Cisco UCS C885A M8 Rack Server; and 22 more.
Is there a fix for CVE-2026-20293?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20293 attacked?
It is attacked with local access or with physical access, in a network appliance.
Am I affected by CVE-2026-20293?
Check whether you run Cisco 5000 Series Enterprise Network Compute Systems, Cisco Application Policy Infrastructure Controller, Cisco HyperFlex Edge Nodes or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from the availability of memory-write commands in the UEFI Shell (CWE-749) when UEFI Secure Boot is enabled. The root cause is insufficient isolation between the interactive shell environment and protected firmware state. An attacker can select the UEFI Shell boot option and use shell commands to modify UEFI memory variables, specifically overwriting Secure Boot-related values. Attack vectors include physical access to keyboard/video/mouse (KVM) for unauthenticated users, or remote/local access for authenticated users with user or admin role. Successful exploitation allows complete bypass of firmware signature validation and execution of arbitrary code in the preboot environment. Cisco's fix removes memory-modification shell commands when Secure Boot is enabled; patches are available for affected BIOS versions.

Affected products

  • Cisco UCS B-Series Blade Servers
  • Cisco UCS C-Series Rack Servers
  • Cisco UCS C845A M8 Rack Server
  • Cisco UCS C885A M8 Rack Server
  • Cisco UCS C880A M8 Rack Server
  • Cisco UCS E-Series M3 Servers
  • Cisco UCS E-Series M6 Servers
  • Cisco UCS S-Series Storage Servers
  • Cisco UCS X-Series Modular System
  • Cisco 5000 Series Enterprise Network Compute Systems
  • Cisco Unified Edge
  • Cisco Application Policy Infrastructure Controller
  • Cisco Telemetry Broker
  • Cisco HyperFlex Edge Nodes
  • Cisco HyperFlex Nodes
  • Cisco IEC6400 Edge Compute Appliances
  • Cisco IOS XRv 9000 M7
  • Cisco Nexus Dashboard
  • Cisco Secure Email Gateway
  • Cisco Secure Email and Web Manager
  • Cisco Secure Endpoint Private Cloud
  • Cisco Secure Firewall Management Center
  • Cisco Secure Malware Analytics
  • Cisco Secure Network Analytics
  • Cisco Secure Network Server
  • Cisco Secure Web Appliances

Timeline

  • 2026-09-08: disclosed
  • 2026-09-08: advisory: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.