# CVE-2026-20093: Cisco IMC Authentication Bypass — Unauthenticated Admin Access via Password Change Manipulation

> Critical authentication bypass vulnerability (CVSS 9.8) in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to bypass authentication and gain full administrative access to UCS C-Series, E-Series, ENCS 5000, and Catalyst 8300 servers by sending crafted XML POST requests to the password change functionality targeting the configConfMo/aaaUser endpoint.

- **Published:** 2026-04-04T12:00:00Z
- **Last reviewed:** 2026-04-04T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0316
- **ID:** TL-2026-0316
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20093

## Description

CVE-2026-20093 is a critical authentication bypass vulnerability in the Cisco Integrated Management Controller (IMC), the out-of-band management service used across Cisco UCS server platforms. The flaw resides in the password change functionality of the IMC web interface and XML API.

The root cause is improper input validation (CWE-20) in how IMC processes password modification requests. The system fails to validate the authorization context during password modification requests before processing backend database updates. An unauthenticated attacker can craft an XML POST request targeting the configConfMo method with the aaaUser object class, manipulating the default admin account Distinguished Name (DN) at sys/user-ext/user-admin. This allows direct credential manipulation without a valid authenticated session.

The attack is network-based with low complexity, requiring no privileges or user interaction. A successful exploit allows the attacker to bypass all authentication mechanisms, alter passwords of any user including the Admin account, and gain full administrative access to the affected system. Through the IMC management interface (accessible via XML API, WebUI, and CLI), an attacker with admin access can control server hardware, modify BIOS settings, access virtual media, monitor hardware health, and potentially pivot to managed workloads.

The vulnerability affects multiple Cisco product families running vulnerable IMC firmware: UCS C-Series M5 and M6 Rack Servers in standalone mode, UCS E-Series M3 and M6 servers, 5000 Series Enterprise Network Compute Systems (ENCS), and Catalyst 8300 Series Edge uCPE. Dependent appliances that embed Cisco IMC are also affected, including APIC Servers, Cyber Vision Center Appliances, Secure Firewall Management Center appliances, and Malware Analytics Appliances.

Notably, UCS B-Series Blade Servers, UCS C-Series M7/M8 Rack Servers, servers managed via Fabric Interconnects in UCS Manager or Intersight Managed Mode, UCS S-Series Storage Servers, and UCS X-Series Modular Systems are NOT affected.

No workarounds exist for this vulnerability. Cisco has released fixed firmware versions and strongly recommends immediate patching. As interim mitigation, organizations should restrict IMC management interface access to trusted networks only, implement network segmentation, and enforce VPN-only or zero-trust access controls for out-of-band management.

The vulnerability was discovered by security researcher 'jyh' and disclosed by Cisco PSIRT on April 1, 2026 as part of a batch that also included CVE-2026-20160, a separate CVSS 9.8 RCE in Cisco Smart Software Manager On-Prem. Cisco PSIRT reports no evidence of active exploitation in the wild as of the disclosure date, though the low complexity and high impact make exploitation highly likely once PoC code circulates.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1556 Modify Authentication Process
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1021 Remote Services
- T1203 Exploitation for Client Execution
- T1082 System Information Discovery
- T1531 Account Access Removal
- T1602 Data from Configuration Repository
- T1595 Active Scanning
- T1071 Application Layer Protocol

## Sources

- [Cisco Security Advisory cisco-sa-cimc-auth-bypass-AgG2BxTn](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn)
- [NVD - CVE-2026-20093](https://nvd.nist.gov/vuln/detail/CVE-2026-20093)
- [BleepingComputer - Critical Cisco IMC auth bypass gives attackers Admin access](https://www.bleepingcomputer.com/news/security/critical-cisco-imc-auth-bypass-gives-attackers-admin-access/)
- [The Hacker News - Cisco Patches 9.8 CVSS IMC and SSM Flaws](https://thehackernews.com/2026/04/cisco-patches-98-cvss-imc-and-ssm-flaws.html)
- [Help Net Security - Cisco IMC auth bypass vulnerability CVE-2026-20093](https://www.helpnetsecurity.com/2026/04/03/cisco-imc-vulnerability-cve-2026-20093/)
- [SOCRadar - CVE-2026-20093: Critical Cisco IMC Flaw](https://socradar.io/blog/cve-2026-20093-cisco-imc-flaw/)
- [CVEReports - CVE-2026-20093 Technical Analysis](https://cvereports.com/reports/CVE-2026-20093)
- [Vulert - Cisco IMC and SSM Vulnerabilities Analysis](https://vulert.com/blog/cisco-imc-ssm-vulnerabilities-cve-2026-20093-20160/)
- [Tenable - CVE-2026-20093](https://www.tenable.com/cve/CVE-2026-20093)
- [Malware News - CVE-2026-20093 Critical Cisco IMC Flaw](https://malware.news/t/cve-2026-20093-critical-cisco-imc-flaw-allows-unauthenticated-admin-access-to-ucs-servers/105706)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0316