highQCS priority 100/100Cisco

Cisco Integrated Management Controller Argument Injection Vulnerabilities

Cisco Integrated Management Controller (IMC) has several security weaknesses in its web-based management interface. These flaws let an attacker who already has some access send malicious inputs that can run any command on the device and gain full system control. Cisco has released software updates to fix these problems, but there are no alternative workarounds. It is important to upgrade your IMC software to protect your systems against potential attacks.

Published 15/9/2026, 8:36:48 pmVerified 15/9/2026, 11:42:30 pmRevision 1

Cisco high network security advisory visual

VendorCisco

Severityhigh

CVSSNot supplied

ExploitationProof-of-concept exploit code for CVE-2026-20200 is publicly available. Cisco is not aware of malicious exploitation in the wild at this time.

ProductsCisco, Cisco Integrated Management Controller, Cisco 5000 Series ENCS, Cisco Catalyst 8300 Series Edge uCPE, Cisco UCS C-Series M5, M6, M7, M8 Rack Servers standalone, Cisco UCS E-Series M3, M6 Servers, Cisco UCS S-Series Storage Servers standalone, Various Cisco appliances based on mentioned UCS C-Series servers including APIC Servers, Business Edition Appliances, Telemetry Broker Appliances, HyperFlex Nodes, Secure Endpoint,, Secure Firewall Management Center, Secure Malware Analytics, Secure Network Analytics, Secure Network Server, and others as listed in the source

CVE identifiersCVE-2026-20200, CVE-2026-20288

In plain language

What this advisory means

Technical explanation

How the issue affects the environment

Two distinct argument injection vulnerabilities exist in the Cisco IMC web interface. They result from improper validation of user-supplied inputs, which allows a remote attacker with authenticated access—low privilege for CVE-2026-20200 and admin privilege for CVE-2026-20288—to execute arbitrary OS commands with root privileges. This escalation occurs by passing crafted inputs through the IMC interface, leading to full system compromise. Cisco has released fixed software releases addressing these flaws; no effective mitigations or workarounds are available. The vulnerabilities carry high severity ratings and have been tracked as CVE-2026-20200 and CVE-2026-20288.

Operational impact

Why teams should care

Successful exploitation leads to complete control over the affected Cisco IMC device's underlying operating system, allowing an attacker to perform unauthorized actions with root privileges. This can cause severe disruption to managed network infrastructure, data breaches, and compromise of enterprise security. Because these vulnerabilities can be remotely exploited by an authenticated attacker, they present a serious risk to organizations relying on Cisco IMC for managing critical compute and network hardware.

Immediate action

Cisco strongly recommends upgrading affected Cisco IMC devices to the specified fixed software releases provided in the advisory. Upgrading ensures the vulnerabilities are fully remediated. The advisory includes detailed version mappings and instructions for different hardware platforms and appliances. No workarounds or mitigations fully address the vulnerabilities, so timely software upgrade is critical.

Affected and fixed releases

Affected versionsConfirm in the official vendor advisory

Fixed versionsConfirm in the official vendor advisory

Temporary risk reduction

There are no workarounds that address these vulnerabilities.

Evidence and validation checklist

Cisco official security advisory document dated 2026-09-15.
Detailed vulnerability descriptions for CVE-2026-20200 and CVE-2026-20288 indicating improper input validation leading to root command execution.
List of affected products and hardware models running vulnerable Cisco IMC releases.
Statements confirming no workarounds are available.
Cisco-provided fixed software release information and upgrade instructions.
Acknowledgement of proof-of-concept exploit availability for CVE-2026-20200.

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source