Cisco Patches Critical IMC Authentication Bypass Enabling Admin Access
Summary
Cisco says unauthenticated attackers can exploit CVE-2026-20093 to bypass authentication and gain Admin access to unpatched IMC systems. No workaround is available; Cisco urges customers to update. The article also covers patches for two other vulnerabilities.
Key points
- CVE-2026-20093 affects Cisco IMC password-change functionality on UCS C-Series and E-Series servers; a crafted HTTP request can let unauthenticated attackers bypass authentication and gain Admin access.
- Cisco says it has found no evidence of in-the-wild exploitation or proof-of-concept code for CVE-2026-20093; no workaround is available, and Cisco strongly recommends upgrading to fixed software.
- CVE-2026-20160 in Smart Software Manager On-Prem can allow unauthenticated remote code execution with root-level privileges through a crafted API request.
- Cisco previously patched CVE-2026-20131, a Secure Firewall Management Center remote code execution flaw exploited in zero-day attacks by the Interlock ransomware gang; CISA added it to its exploited-vulnerability catalog.
- The article reports that Cisco's internal development environment was breached using credentials stolen during the Trivy supply chain attack.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Severity
- Critical
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-20093Cisco · Cisco Enterprise NFV Infrastructure Software; Cisco · Cisco Unified Computing System (Standalone); +1 morecritical vulnerabilities, including an Integrated Management Controller (IMC) authentication bypass (CVE-2026-20093) that can let attackers gain Admin access to UCS CâSeries and EâSeries servers.CVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)Smart Software Manager OnâPrem RCE (CVE-2026-20160), the FMC RCE previously exploited by Interlock (CVE-2026-20131), and follow a reported breach tied to the Trivy supply chain attack.CVE-2026-20160Cisco · Cisco Smart Software Manager On-Prembecause there are no mitigations; fixes also cover a Smart Software Manager OnâPrem RCE (CVE-2026-20160), the FMC RCE previously exploited by Interlock (CVE-2026-20131), and follow a reported breach tied
Threat Actors
Vendors
Products
Cisco IMCCVE-2026-20093 in Cisco IMC allows unauthenticated attackers to bypass authentication and obtain Admin privileges.Cisco Secure Firewall Management CenterEarlier this month, Cisco patched a maximum-severity RCE vulnerability (CVE-2026-20131) in the Secure Firewall Management Center (FMC) that the Interlock ransomware gang exploited in zero-day attacks.E-Seriesout-of-band management (even if the operating system is powered off or crashed) for UCS C-Series and E-Series servers via multiple interfaces, including XML API, web (WebUI), and command-line (CLI).Smart Software Manager On-PremThis week, Cisco has also released patches for a critical Smart Software Manager On-Prem (SSM On-Prem) vulnerability (CVE-2026-20160) that could enable threat actors without privileges to gain remote code executionUCS C-Seriesthat provides out-of-band management (even if the operating system is powered off or crashed) for UCS C-Series and E-Series servers via multiple interfaces, including XML API, web (WebUI), and command-line (CLI).