Loading story…
Cisco disclosed command injection and remote code execution vulnerabilities affecting Cisco Integrated Management Controller (CIMC), warning that the flaws could allow an attacker to execute arbitrary commands or code on impacted systems. The advisory identifies the issue as affecting CIMC and frames it as a serious compromise path into server management infrastructure, where successful exploitation could give an attacker control over administrative functions and underlying devices.
The vulnerabilities were published in a Cisco security advisory under the topic "Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities." Organizations using Cisco CIMC are expected to review the vendor advisory, determine whether exposed or internet-reachable management interfaces are affected, and apply Cisco-provided fixes or mitigations to reduce the risk of unauthorized command execution on management controllers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco published a security advisory for Cisco Integrated Management Controller vulnerabilities involving command injection and remote code execution. No additional technical details, exploitation information, or remediation timeline are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
sec.cloudapps.cisco.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed multiple vulnerabilities in its Integrated Management Controller (**IMC**), including the critical `CVE-2026-20093`, which allows a remote, unauthenticated attacker to send a crafted HTTP request to bypass authentication and change passwords for existing users, including the primary Admin account. Cisco rated the flaw **CVSS 9.8** and said no workarounds or mitigations are available, making vendor-issued software updates the only effective fix; the company added that it has no evidence of active exploitation or public malicious use. Additional advisories cover `CVE-2026-20094` through `CVE-2026-20097`, spanning command injection and arbitrary code execution issues that could let attackers execute commands or code as `root` and fully compromise affected systems. Impacted products include Cisco UCS C-Series and S-Series servers, UCS E-Series systems, Catalyst 8300 Series Edge uCPE, 5000 Series ENCS, and other Cisco appliances built on vulnerable UCS platforms, with Cisco publishing fixed-version guidance and upgrade paths while runZero released an inventory query to help organizations identify exposed IMC assets.
Jun 29, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026
dCERT issued advisories for **Cisco Catalyst SD-WAN Manager** and the **SD-WAN Controller**, warning of multiple security flaws affecting core SD-WAN management components. One advisory covers several vulnerabilities across the management platform and controller, indicating broader exposure in systems used to administer and orchestrate enterprise SD-WAN environments. A separate dCERT advisory identifies a **cross-site scripting (XSS)** vulnerability in Cisco Catalyst SD-WAN Manager, highlighting the risk that attackers could inject malicious script into the web-based management interface. Together, the notices point to security weaknesses in Cisco SD-WAN administrative infrastructure that could affect the confidentiality and integrity of management sessions and require prompt review and remediation by defenders.
Jun 29, 2026