CVE-2026-20093: Cisco IMC Authentication Bypass — Unauthenticated Admin Access via Password Change Manipulation
CVE-2026-20093 (TL-2026-0316), also tracked as cisco-sa-cimc-auth-bypass-AgG2BxTn, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-04. It has no confirmed attribution, affects Cisco UCS C-Series M5 Rack Servers (Standalone), references 1 CVE (CVE-2026-20093), maps to 11 MITRE ATT&CK techniques (T1021, T1071, T1078), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0316
- Threat ID
- TL-2026-0316
- Also known as
- cisco-sa-cimc-auth-bypass-AgG2BxTn, CSCwq55648, CSCwq55659, CSCwq68912
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-04-04
- Last reviewed
- 2026-04-04
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, government, financial, healthcare, telecommunications, education, manufacturing, defense, energy, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Critical authentication bypass vulnerability (CVSS 9.8) in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to bypass authentication and gain full administrative access to UCS C-Series, E-Series, ENCS 5000, and Catalyst 8300 servers by sending crafted XML POST requests to the password change functionality targeting the configConfMo/aaaUser endpoint.
How CVE-2026-20093 works
CVE-2026-20093 is a critical authentication bypass vulnerability in the Cisco Integrated Management Controller (IMC), the out-of-band management service used across Cisco UCS server platforms. The flaw resides in the password change functionality of the IMC web interface and XML API.
The root cause is improper input validation (CWE-20) in how IMC processes password modification requests. The system fails to validate the authorization context during password modification requests before processing backend database updates. An unauthenticated attacker can craft an XML POST request targeting the configConfMo method with the aaaUser object class, manipulating the default admin account Distinguished Name (DN) at sys/user-ext/user-admin. This allows direct credential manipulation without a valid authenticated session.
The attack is network-based with low complexity, requiring no privileges or user interaction. A successful exploit allows the attacker to bypass all authentication mechanisms, alter passwords of any user including the Admin account, and gain full administrative access to the affected system. Through the IMC management interface (accessible via XML API, WebUI, and CLI), an attacker with admin access can control server hardware, modify BIOS settings, access virtual media, monitor hardware health, and potentially pivot to managed workloads.
The vulnerability affects multiple Cisco product families running vulnerable IMC firmware: UCS C-Series M5 and M6 Rack Servers in standalone mode, UCS E-Series M3 and M6 servers, 5000 Series Enterprise Network Compute Systems (ENCS), and Catalyst 8300 Series Edge uCPE. Dependent appliances that embed Cisco IMC are also affected, including APIC Servers, Cyber Vision Center Appliances, Secure Firewall Management Center appliances, and Malware Analytics Appliances.
Notably, UCS B-Series Blade Servers, UCS C-Series M7/M8 Rack Servers, servers managed via Fabric Interconnects in UCS Manager or Intersight Managed Mode, UCS S-Series Storage Servers, and UCS X-Series Modular Systems are NOT affected.
No workarounds exist for this vulnerability. Cisco has released fixed firmware versions and strongly recommends immediate patching. As interim mitigation, organizations should restrict IMC management interface access to trusted networks only, implement network segmentation, and enforce VPN-only or zero-trust access controls for out-of-band management.
The vulnerability was discovered by security researcher 'jyh' and disclosed by Cisco PSIRT on April 1, 2026 as part of a batch that also included CVE-2026-20160, a separate CVSS 9.8 RCE in Cisco Smart Software Manager On-Prem. Cisco PSIRT reports no evidence of active exploitation in the wild as of the disclosure date, though the low complexity and high impact make exploitation highly likely once PoC code circulates.
MITRE ATT&CK techniques used in TL-2026-0316
lateral-movement
command-and-control
T1071 Application Layer Protocol
defense-evasion
discovery
T1082 System Information Discovery
persistence
initial-access
T1190 Exploit Public-Facing Application
execution
T1203 Exploitation for Client Execution
impact
credential-access
T1556 Modify Authentication Process
reconnaissance
collection
Affected products and versions in CVE-2026-20093
- Cisco — UCS C-Series M5 Rack Servers (Standalone)
Vulnerable versions: <= 4.2(3p)
Fixed in: 4.3(2.260007); 4.3(6.260017); 6.0(1.250174) - Cisco — UCS C-Series M6 Rack Servers (Standalone)
Vulnerable versions: <= 4.2(3p)
Fixed in: 4.3(2.260007); 4.3(6.260017); 6.0(1.250174) - Cisco — UCS E-Series M3 Servers
Vulnerable versions: <= 3.2.16.1
Fixed in: 3.2.17 - Cisco — UCS E-Series M6 Servers
Vulnerable versions: <= 3.2.16.1
Fixed in: 4.15.3 - Cisco — 5000 Series Enterprise Network Compute Systems (ENCS)
Vulnerable versions: <= 4.18.2a
Fixed in: 4.15.5 - Cisco — Catalyst 8300 Series Edge uCPE
Vulnerable versions: <= 4.18.2a
Fixed in: 4.18.3 - Cisco — Integrated Management Controller (IMC)
Vulnerable versions: All versions prior to fixed releases
Fixed in: See per-platform fixed versions
Remediation for CVE-2026-20093
Patches
- UCS C-Series M5/M6 Standalone: Upgrade to firmware 4.3(2.260007), 4.3(6.260017), or 6.0(1.250174)
- UCS E-Series M3: Upgrade to firmware 3.2.17
- UCS E-Series M6: Upgrade to firmware 4.15.3
- 5000 Series ENCS: Upgrade to firmware 4.15.5
- Catalyst 8300 Series Edge uCPE: Upgrade to firmware 4.18.3
Immediate actions
- Restrict Cisco IMC management interface access to trusted management networks only
- Implement network segmentation to isolate out-of-band management interfaces from general network traffic
- Enforce VPN-only or zero-trust access controls for all BMC/IMC management interfaces
- Monitor IMC audit logs for unauthorized password change events or anomalous configConfMo API calls
- Review all IMC user accounts for unauthorized modifications
- Block direct internet access to IMC management ports (443, 80, 623)
Workarounds
- No vendor workarounds available — firmware upgrade is the only remediation
- Interim: Restrict management interface access to trusted networks via ACLs and firewall rules
Longer-term hardening
- Deploy network monitoring for anomalous XML API requests to IMC endpoints
- Implement SIEM alerting for unauthorized IMC password change events
- Establish firmware patch management program for all out-of-band management controllers
- Conduct inventory of all Cisco IMC-managed servers to identify affected assets
- Implement jump server architecture for all out-of-band management access
CVEs associated with CVE-2026-20093
Weaknesses (CWE) in CVE-2026-20093
CWE-20
Timeline of CVE-2026-20093
- Security researcher 'jyh' reports authentication bypass vulnerability to Cisco PSIRT via responsible disclosure
- Cisco releases fixed firmware for UCS C-Series (4.3(2.260007), 4.3(6.260017), 6.0(1.250174)), E-Series M3 (3.2.17), E-Series M6 (4.15.3), ENCS 5000 (4.15.5), Catalyst 8300 (4.18.3)
- CVE-2026-20093 published in NVD and CVE record received at 13:28:29 UTC
- Cisco PSIRT publishes security advisory cisco-sa-cimc-auth-bypass-AgG2BxTn with CVSS 9.8 rating and fixed firmware versions
- BleepingComputer, The Hacker News, and security media publish technical analysis. Vulnerability gains widespread attention alongside CVE-2026-20160 SSM RCE
- NVD updates CVE-2026-20093 record; status remains Awaiting Analysis. EPSS score assessed at 0.00031 (8.76th percentile)
- Help Net Security and security researchers publish detailed technical analysis including XML API attack vector details (configConfMo/aaaUser exploitation path)
- Threadlinqs Intelligence Platform publishes comprehensive threat analysis TL-2026-0316 with full MITRE ATT&CK mapping and detection coverage
- As of 2026-05-29, CVE-2026-20093 (Cisco IMC CVSS 9.8 auth bypass) has fixed firmware shipped Apr 1-2 2026 and remains unexploited with no public PoC, no in-the-wild attacks, and no CISA KEV listing (very low EPSS). It stays a live concern for unpatched, internet-exposed IMC interfaces given the unauthenticated, low-complexity, no-workaround nature.
Sources cited for CVE-2026-20093
- Cisco Security Advisory cisco-sa-cimc-auth-bypass-AgG2BxTn
- NVD - CVE-2026-20093
- BleepingComputer - Critical Cisco IMC auth bypass gives attackers Admin access
- The Hacker News - Cisco Patches 9.8 CVSS IMC and SSM Flaws
- Help Net Security - Cisco IMC auth bypass vulnerability CVE-2026-20093
- SOCRadar - CVE-2026-20093: Critical Cisco IMC Flaw
- CVEReports - CVE-2026-20093 Technical Analysis
- Vulert - Cisco IMC and SSM Vulnerabilities Analysis
- Tenable - CVE-2026-20093
- Malware News - CVE-2026-20093 Critical Cisco IMC Flaw
Threats related to CVE-2026-20093
- Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032)
- CVE-2026-46817: Unauthenticated Arbitrary File Read in Oracle E-Business Suite Payments File Transmission Exploited Before Public PoC
- CVE-2026-17059: Keycloak Admin REST API Broken Object-Level Authorization Exposes User PII
Detection coverage for TL-2026-0316
As of 2026-04-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0316 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.