highQCS priority 100/100Cisco

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

Cisco UCS servers and UCS-based appliances have a security vulnerability that allows attackers to bypass UEFI Secure Boot, a security feature that helps prevent unauthorized software from loading during startup. This flaw arises because certain memory write commands remain accessible in the UEFI Shell when Secure Boot is enabled. Attackers with either valid user credentials or physical access can exploit this to run unauthorized software. Cisco has released software updates to fix this issue, but no temporary workarounds are available; upgrading to the fixed versions is strongly recommended.

QCS published 9/9/2026, 4:09:49 am ISTVendor disclosure 14/10/2026, 2:35:13 am ISTVerified 14/10/2026, 4:08:31 am ISTRevision 3

VendorCisco

Severityhigh

CVSSNot supplied

ExploitationProof-of-concept exploit code is publicly available. Cisco is not aware of active malicious exploits in the wild as of the last update (October 2026).

ProductsCisco, Cisco UCS Servers, Cisco UCS 5000 Series Enterprise Network Compute Systems (ENCS), Cisco UCS B-Series Blade Servers, Cisco UCS C-Series Rack Servers, Cisco UCS C845A M8 Rack Server, Cisco UCS C885A M8 Rack Server, Cisco UCS C880A M8 Rack Server, Cisco UCS E-Series M3 and M6 Servers, Cisco UCS S-Series Storage Servers, Cisco UCS X-Series Modular System, Cisco Unified Edge, Cisco Application Policy Infrastructure Controller (APIC) Servers, Cisco Telemetry Broker Appliances, Cisco HyperFlex Edge and Nodes, Cisco IEC6400 Edge Compute Appliances, Cisco IOS XRv 9000 M7 Appliances, Cisco Nexus Dashboard Appliances, Cisco Secure Email Gateways, Secure Email and Web Manager, Secure Endpoint Private Cloud Appliances, Cisco Secure Firewall Management Center (FMC) Appliances, Cisco Secure Malware Analytics Appliances, Cisco Secure Network Analytics Appliances, Cisco Secure Network Server (ISE SNS) Appliances, Cisco Secure Web Appliances

CVE identifiersCVE-2026-20293

In plain language

What this advisory means

Technical explanation

How the issue affects the environment

The vulnerability exists in the UEFI Shell implementation on Cisco UCS servers and UCS-based appliances when UEFI Secure Boot is enabled. The UEFI Shell provides commands that allow modification of memory. Some of these memory write commands remain accessible even when Secure Boot is active, enabling an attacker to alter UEFI memory variables at boot time by selecting the UEFI Shell boot option. This can corrupt Secure Boot state values in memory, effectively bypassing Secure Boot validation checks and allowing unauthorized software to execute early in the boot process. Cisco's remediation involves removing these memory write commands from the UEFI Shell when Secure Boot is enabled. Fixed software releases that implement this remediation are available for affected products.

Operational impact

Why teams should care

Successful exploitation allows an attacker to bypass Secure Boot protections on Cisco UCS servers and appliances. This undermines the integrity of the boot process, enabling execution of unauthorized software before the operating system loads. Such unauthorized code execution can lead to malware persistence, evasion of security controls, and compromise of the entire device. Given the critical role of UCS servers in enterprise infrastructure, this vulnerability poses a high security risk and could impact business operations and data security.

Immediate action

Cisco strongly recommends customers upgrade affected devices to the specified fixed software releases that remove the memory write commands from the UEFI Shell when Secure Boot is enabled. This upgrade mitigates the vulnerability and prevents bypass of Secure Boot validation. No workarounds are available, so prompt software updates are critical to secure affected Cisco UCS hardware and appliance platforms.

Affected and fixed releases

Affected versionsVersions earlier than the indicated fixed releases for each product line as specified in the advisory; e.g., UCS 5000 Series ENCS releases earlier than 4.12.9, UCS B-Series M5 andM, 6 servers in certain releases prior to 4.3(6k) and 4.3(6h), UCS C-Series releases prior to 4.2 and 4.3, UCS E-Series earlier than 4.04 (M3) and 4.15.4b (M6), and others as per the detailed advisory tables

Fixed versions5000 Series ENCS: 4.12.9 and later (Jan 2027), 4.15.7 and later (Nov 2026), UCS B-Series M5 Servers (UCS Manager mode): 4.3(6k) and later, UCS B-Series M6 and X-Series (UCS Manager mode): 4.3(6h) and later, UCS B-Series M5 and M6 (Intersight Managed mode): Versions released Nov 2026 or later, UCS C845A M8: release TBD Oct 2026, UCS C885A M8: 4.0(2.260004) and later, UCS C880A M8: release TBD Oct 2026, UCS C-Series M5/M6/M7/M8: starting 4.2(3r), 4.3 and 6.0 releases, UCS E-Series M3: 4.04 BIOS release, UCS E-Series M6: 4.15.4b with BIOS 2.06, UCS S-Series Storage Servers: 4.3(6.260054) and later, Unified Edge: 6.0(2.260143) and later, Various Cisco UCS-based appliances as per fixed firmware releases listed in advisory

Temporary risk reduction

There are no workarounds that address this vulnerability. Physical security controls to restrict unauthorized access may help reduce risk but do not mitigate the vulnerability itself.

Evidence and validation checklist

Cisco Security Advisory cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW published 2026-09-08 and updated 2026-10-13
CVE-2026-20293 identifier assigned by Cisco
Detailed vulnerability description and technical explanation in Cisco advisory
Software fix descriptions removing memory write commands in UEFI Shell
Multiple product lines and firmware/software versions listed as affected and fixed
No workaround reported in the advisory
Proof-of-concept exploit code known, but no active exploitation reported

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source