CVE-2026-20200: Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability

Published Aug 5, 2026

Updated

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.  This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. 

Affected Software

39 affected components

Cisco Cisco IMC

Cisco Unified Computing System=4.3\(1.230097\)

Cisco Unified Computing System=4.3\(1.230124\)

Cisco Unified Computing System=4.3\(1.230138\)

Cisco Unified Computing System=4.3\(2.230207\)

Cisco Unified Computing System=4.3\(2.230270\)

Cisco Unified Computing System=4.3\(2.240002\)

Cisco Unified Computing System=4.3\(3.240022\)

Cisco Unified Computing System=4.3\(3.240043\)

Cisco Unified Computing System=4.3\(4.240142\)

Cisco Unified Computing System=4.3\(4.240152\)

Cisco Unified Computing System=4.3\(4.241014\)

Cisco Unified Computing System=4.3\(4.241063\)

Cisco Unified Computing System=4.3\(4.242028\)

Cisco Unified Computing System=4.3\(4.242038\)

Cisco Unified Computing System=4.3\(4.242066\)

Cisco Unified Computing System=4.3\(4.252001\)

Cisco Unified Computing System=4.3\(4.252002\)

Cisco Unified Computing System=4.3\(5.240021\)

Cisco Unified Computing System=4.3\(5.250001\)

Cisco Unified Computing System=4.3\(5.250030\)

Cisco Unified Computing System=4.3\(5.250033\)

Cisco Unified Computing System=4.3\(5.250043\)

Cisco Unified Computing System=4.3\(5.250045\)

Cisco Unified Computing System=4.3\(6.250039\)

Cisco Unified Computing System=4.3\(6.250040\)

Cisco Unified Computing System=4.3\(6.250044\)

Cisco Unified Computing System=4.3\(6.250053\)

Cisco Unified Computing System=4.3\(6.250060\)

Cisco Unified Computing System=4.3\(6.250101\)

Cisco Unified Computing System=4.3\(6.250117\)

Cisco Unified Computing System=4.3\(6.260003\)

Cisco Unified Computing System=4.3\(6.260017\)

Cisco Unified Computing System=6.0\(1.250127\)

Cisco Unified Computing System=6.0\(1.250130\)

Cisco Unified Computing System=6.0\(1.250131\)

Cisco Unified Computing System=6.0\(1.250174\)

Cisco Unified Computing System=6.0\(1.250192\)

Cisco Unified Computing System=6.0\(1.250194\)

Event History

Aug 5, 2026

CVE Published

via MITRE·04:18 PM

Data Sourced

via MITRE·04:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-20200?

The severity of CVE-2026-20200 is rated as high with a CVSS score of 8.8.

How do I fix CVE-2026-20200?

To fix CVE-2026-20200, ensure that you upgrade to the latest Cisco IMC version as provided by Cisco.

What type of attacks can CVE-2026-20200 facilitate?

CVE-2026-20200 can facilitate arbitrary command execution and privilege escalation on affected systems.

Who is affected by CVE-2026-20200?

Authenticated remote attackers with low privileges can exploit CVE-2026-20200 on affected Cisco IMC systems.

What systems are impacted by CVE-2026-20200?

CVE-2026-20200 specifically impacts Cisco Integrated Management Controller (IMC) systems.