Critical Auth Bypass in Cisco Integrated Management Controller (CVE‑2026‑20093) Enables Password Reset
What It Is – Cisco disclosed ten IMC‑related flaws; the most severe (CVE‑2026‑20093) lets an unauthenticated remote attacker bypass authentication and change any user’s password, including the Admin account. The vulnerability stems from improper handling of password‑change HTTP requests.
Exploitability – No public exploits or active attacks have been observed, but a working proof‑of‑concept exists and the flaw is trivially exploitable with a crafted request. CVSS v3.1 is estimated at 9.8 (Critical).
Affected Products – Cisco Integrated Management Controller (IMC) firmware on UCS C‑Series servers, UCS B‑Series, UCS X‑Series, APIC Servers, Cyber Vision Center appliances, Secure Firewall Management Center, Malware Analytics appliances, and any Cisco device exposing the IMC web UI.
TPRM Impact – The IMC is a common management layer for many downstream services; a breach can cascade to any third‑party relying on compromised Cisco hardware, creating a supply‑chain foothold and potential data exposure across multiple industries.
Recommended Actions –
- Apply Cisco’s security patches for all ten IMC vulnerabilities immediately.
- Segregate IMC interfaces onto a dedicated management VLAN; block public Internet access.
- Enforce strong network‑level authentication (e.g., VPN, Zero‑Trust) for any IMC traffic.
- Conduct a rapid inventory of all Cisco devices exposing IMC and verify patch status.
- Update third‑party risk registers to reflect the elevated risk of Cisco‑based infrastructure.
Source: Help Net Security – Cisco IMC vulnerability (CVE‑2026‑20093)