Critical Cisco IMC Argument Injection (CVE-2026-20200) Enables Root RCE on UCS C-Series M7/M8 Standalone Servers — Public PoC (CIMCown) — Threadlinqs Intelligence
As of 2026-08-06, Critical Cisco IMC Argument Injection (CVE-2026-20200) Enables Root RCE on UCS C-Series M7/M8 Standalone Servers — Public PoC (CIMCown) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 9 indicators of compromise.
Threat ID: TL-2026-1912 · Severity: CRITICAL · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
CVE-2026-20200 is a critical argument injection vulnerability in the web-based management interface of the Cisco Integrated Management Controller (IMC), the out-of-band BMC on UCS C-Series M7/M8 rack
CVE-2026-20200 is an argument injection (CWE-141 / CWE-146) vulnerability in the web-based management interface of the Cisco Integrated Management Controller (IMC), the baseboard management controller (BMC) that provides out-of-band management for Cisco UCS C-Series rack servers and S-Series storage servers. The flaw, discovered by Christoph Peil of NSIDE ATTACK LOGIC during a commissioned security assessment, stems from improper validation of user-supplied input. An authenticated, remote attacker holding only low-privilege (e.g., read-only) credentials can enter crafted input to the web UI and execute arbitrary commands on the underlying IMC operating system as root, fully escalating privileges. Cisco assigned CVSS 8.8 (High SIR); NSIDE assesses 9.9 with a changed-scope vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The hunt skeleton and media coverage cite a 9.8 critical rating, reflecting the severity of self-hosted UCS exposure.
The root cause is a shell-script argument injection in the IMC's SSH key import functionality. When a user requests that the IMC fetch an SSH public key from a remote server over HTTP or FTP, the backend invokes a script effectively equivalent to `/etc/scripts/download_ssh_keys.sh http <host> <destination>`, which forwards user-controlled parameters directly to the curl binary. Because the script and curl execute with root privileges, an attacker can inject additional curl flags (for example `-o` to write arbitrary files, `--upload-file` to exfiltrate files, or `-K` to read files as curl config) to achieve arbitrary file read, file write, and — via loading a crafted library — full command execution as root.
The NSIDE-released CIMCown toolkit operationalizes this. It connects to a low-privilege account on the IMC web/API interface, and supports (1) `test` — downloads `/etc/passwd` as a connectivity check, (2) `download` — retrieves any remote file from the IMC, (3) `upload` — writes a file to an arbitrary remote path, (4) `build` — compiles a Go-based reverse shell for the IMC's ARM architecture, and (5) `shell` — deploys and executes the reverse shell against an attacker listener. The exploit drops a shared library (`lib.so`) and a compiled Go reverse shell binary into `/tmp/main` on the IMC, and supports HTTP proxy routing (`--proxy`).
The IMC occupies a privileged architectural position that makes root compromise especially damaging. As an out-of-band BMC it runs its own management OS with dedicated RAM and network interface, independent of the host OS. Root access to the IMC lets an attacker influence BIOS/UEFI and SecureBoot settings, interact directly with running host OS instances, power-cycle servers, and persist below the operating system — far below what OS-level EDR and endpoint defenses can observe. NSIDE describes the IMC as 'an operating system for the operating system.' Cisco stated it was not aware of malicious exploitation at the time of publication but confirmed proof-of-concept exploit code is publicly available.
This advisory (cisco-sa-cimc-arg-inject-upSHdMfU) also discloses a companion vulnerability, CVE-2026-20288, an admin-privilege argument injection (CVSS 6.5) affecting a broader set of platforms including UCS C-Series M5/M6, S-Series storage servers, 5000 Series ENCS, Catalyst 8300 uCPE, and UCS E-Series. CVE-2026-20200 specifically affects UCS C-Series M7 and M8 standalone rack servers. The vulnerability follows the historical pattern of CVE-2024-20356 (CISCown, LRQA Nettitude), a curl-command-injection in Cisco CIMC firmware-update functionality, evidencing a systemic weakness in how IMC passes user input to curl. It is part of a wider 2026 wave of IMC vulnerabilities including CVE-2026-20093 (unauthenticated auth bypass, CVSS 9.8) and CVE-2026-20094 (read-only command injection, CVSS 8.8). No workarounds are available; the only remediation is upgrading IMC firmware to fixed releases.
Weaknesses (CWE)
CWE-141, CWE-146
Target sectors: datacenter, enterprise, telecoms, government administration, cloudserviceprovider, health
Target regions: Global
Detections & IOCs
As of 2026-08-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 9 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-20200, CVE-2026-20288, T1190, T1078, T1059, T1542, T1014, T1562, T1552, T1082, T1021, T1056
