CVE-2026-20097
Analyzed
Analyzed - Analysis Complete
Remote Code Execution via Input Validation Flaw in Cisco IMC
Vulnerability report for CVE-2026-20097, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-04-01
Last updated on: 2026-08-28
Assigner: Cisco Systems, Inc.
Description
Description
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | unified_computing_system | 4.1(2a) |
| cisco | unified_computing_system | 4.1(2b) |
| cisco | unified_computing_system | 4.1(3b) |
| cisco | unified_computing_system | 4.1(3c) |
| cisco | unified_computing_system | 4.1(3d) |
| cisco | unified_computing_system | 4.2(1c) |
| cisco | unified_computing_system | 4.2(1f) |
| cisco | unified_computing_system | 4.1(3f) |
| cisco | unified_computing_system | 4.2(1i) |
| cisco | unified_computing_system | 4.1(3h) |
| cisco | unified_computing_system | 4.1(3i) |
| cisco | unified_computing_system | 4.2(2a) |
| cisco | unified_computing_system | 4.2(3b) |
| cisco | unified_computing_system | 4.2(3d) |
| cisco | unified_computing_system | 4.2(3e) |
| cisco | unified_computing_system | 4.2(3g) |
| cisco | unified_computing_system | 4.1(3l) |
| cisco | unified_computing_system | 4.2(3h) |
| cisco | unified_computing_system | 4.2(3i) |
| cisco | unified_computing_system | 4.1(3m) |
| cisco | unified_computing_system | 4.2(3j) |
| cisco | unified_computing_system | 3.1(2b) |
| cisco | unified_computing_system | 3.1(2c) |
| cisco | unified_computing_system | 3.1(2d) |
| cisco | unified_computing_system | 3.1(2e) |
| cisco | unified_computing_system | 3.1(2g) |
| cisco | unified_computing_system | 3.1(3a) |
| cisco | unified_computing_system | 3.1(3b) |
| cisco | unified_computing_system | 3.1(3c) |
| cisco | unified_computing_system | 3.1(3d) |
| cisco | unified_computing_system | 3.1(3h) |
| cisco | unified_computing_system | 3.1(3j) |
| cisco | unified_computing_system | 3.1(3k) |
| cisco | unified_computing_system | 4.0(1a) |
| cisco | unified_computing_system | 4.0(1b) |
| cisco | unified_computing_system | 4.0(1c) |
| cisco | unified_computing_system | 4.0(1d) |
| cisco | unified_computing_system | 4.0(2d) |
| cisco | unified_computing_system | 4.0(4b) |
| cisco | unified_computing_system | 4.0(4c) |
| cisco | unified_computing_system | 4.0(4d) |
| cisco | unified_computing_system | 4.0(4e) |
| cisco | unified_computing_system | 4.0(4f) |
| cisco | unified_computing_system | 4.0(4h) |
| cisco | unified_computing_system | 4.0(4i) |
| cisco | unified_computing_system | 4.0(4k) |
| cisco | unified_computing_system | 4.0(4l) |
| cisco | unified_computing_system | 4.0(4m) |
| cisco | unified_computing_system | 4.0(4n) |
| cisco | unified_computing_system | 4.1(1c) |
| cisco | unified_computing_system | 4.1(1d) |
| cisco | unified_computing_system | 3.1(3g) |
| cisco | unified_computing_system | 3.1(3i) |
| cisco | unified_computing_system | 4.0(1.240) |
| cisco | unified_computing_system | 4.0(1e) |
| cisco | unified_computing_system | 4.0(1g) |
| cisco | unified_computing_system | 4.0(1h) |
| cisco | unified_computing_system | 4.0(2c) |
| cisco | unified_computing_system | 4.0(2f) |
| cisco | unified_computing_system | 4.0(2h) |
| cisco | unified_computing_system | 4.0(2i) |
| cisco | unified_computing_system | 4.0(2l) |
| cisco | unified_computing_system | 4.0(2n) |
| cisco | unified_computing_system | 4.0(2o) |
| cisco | unified_computing_system | 4.0(2p) |
| cisco | unified_computing_system | 4.0(2q) |
| cisco | unified_computing_system | 4.0(2r) |
| cisco | unified_computing_system | 4.1(1f) |
| cisco | unified_computing_system | 4.1(1g) |
| cisco | unified_computing_system | 4.1(1h) |
| cisco | unified_computing_system | 4.1(2d) |
| cisco | unified_computing_system | 4.1(2e) |
| cisco | unified_computing_system | 4.1(2f) |
| cisco | unified_computing_system | 4.1(2g) |
| cisco | unified_computing_system | 4.1(2h) |
| cisco | unified_computing_system | 4.1(2j) |
| cisco | unified_computing_system | 4.1(2k) |
| cisco | unified_computing_system | 4.1(2l) |
| cisco | unified_computing_system | 4.1(2m) |
| cisco | unified_computing_system | 4.1(3n) |
| cisco | unified_computing_system | 4.2(1a) |
| cisco | unified_computing_system | 4.2(1b) |
| cisco | unified_computing_system | 4.2(1e) |
| cisco | unified_computing_system | 4.2(1g) |
| cisco | unified_computing_system | 4.2(1j) |
| cisco | unified_computing_system | 4.2(2f) |
| cisco | unified_computing_system | 4.2(2g) |
| cisco | unified_computing_system | 4.2(3l) |
| cisco | unified_computing_system | 4.2(3m) |
| cisco | unified_computing_system | 4.2(3n) |
| cisco | unified_computing_system | 4.2(3o) |
| cisco | unified_computing_system | 4.2(3p) |
| cisco | unified_computing_system | 4.3(1.230097) |
| cisco | unified_computing_system | 4.3(1.230124) |
| cisco | unified_computing_system | 4.3(1.230138) |
| cisco | unified_computing_system | 4.3(2.230207) |
| cisco | unified_computing_system | 4.3(2.230270) |
| cisco | unified_computing_system | 4.3(2.240002) |
| cisco | unified_computing_system | 4.3(2.240009) |
| cisco | unified_computing_system | 4.3(2.240037) |
| cisco | unified_computing_system | 4.3(2.240053) |
| cisco | unified_computing_system | 4.3(2.240077) |
| cisco | unified_computing_system | 4.3(2.240090) |
| cisco | unified_computing_system | 4.3(2.240107) |
| cisco | unified_computing_system | 4.3(2.250016) |
| cisco | unified_computing_system | 4.3(2.250021) |
| cisco | unified_computing_system | 4.3(2.250022) |
| cisco | unified_computing_system | 4.3(2.250037) |
| cisco | unified_computing_system | 4.3(2.250045) |
| cisco | unified_computing_system | 4.3(2.250063) |
| cisco | unified_computing_system | 4.3(3.240022) |
| cisco | unified_computing_system | 4.3(3.240043) |
| cisco | unified_computing_system | 4.3(4.240142) |
| cisco | unified_computing_system | 4.3(4.240152) |
| cisco | unified_computing_system | 4.3(4.241014) |
| cisco | unified_computing_system | 4.3(4.241063) |
| cisco | unified_computing_system | 4.3(4.242028) |
| cisco | unified_computing_system | 4.3(4.242038) |
| cisco | unified_computing_system | 4.3(4.242066) |
| cisco | unified_computing_system | 4.3(4.252001) |
| cisco | unified_computing_system | 4.3(4.252002) |
| cisco | unified_computing_system | 4.3(5.240021) |
| cisco | unified_computing_system | 4.3(5.250001) |
| cisco | unified_computing_system | 4.3(5.250030) |
| cisco | unified_computing_system | 4.3(5.250033) |
| cisco | unified_computing_system | 4.3(5.250043) |
| cisco | unified_computing_system | 4.3(5.250045) |
| cisco | unified_computing_system | 4.3(6.250039) |
| cisco | unified_computing_system | 4.3(6.250040) |
| cisco | unified_computing_system | 4.3(6.250044) |
| cisco | unified_computing_system | 4.3(6.250053) |
| cisco | unified_computing_system | 4.3(6.250060) |
| cisco | unified_computing_system | 4.3(6.250101) |
| cisco | unified_computing_system | 4.3(6.250117) |
| cisco | unified_computing_system | 4.3(6.260003) |
| cisco | unified_computing_system | 6.0(1.250127) |
| cisco | unified_computing_system | 6.0(1.250130) |
| cisco | unified_computing_system | 6.0(1.250131) |
| cisco | unified_computing_system | 6.0(1.250174) |
| cisco | unified_computing_system | 6.0(1.250192) |
| cisco | unified_computing_system | 6.0(1.250194) |
| cisco | unified_computing_system | 3.1(1d) |
| cisco | unified_computing_system | 3.1(2i) |
| cisco | unified_computing_system | 4.0(2g) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
