CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability
A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20093?
The severity of CVE-2026-20093 is rated as critical due to its potential for remote unauthenticated access.
How do I fix CVE-2026-20093?
To fix CVE-2026-20093, you should apply the available patches from Cisco for the Integrated Management Controller.
What systems are affected by CVE-2026-20093?
CVE-2026-20093 affects Cisco Integrated Management Controllers (IMC) specifically.
Can CVE-2026-20093 be exploited remotely?
Yes, CVE-2026-20093 can be exploited remotely by unauthenticated attackers to gain administrative access.
What is the impact of CVE-2026-20093?
The impact of CVE-2026-20093 includes unauthorized access to the Cisco Integrated Management Controller with administrative privileges.