CVE-2026-20200

Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability

State: Published
Severity: 8.8 High
Published: Aug 5, 2026
Updated: Sep 16, 2026
Reserved: Oct 8, 2025

Description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. 

This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user. 

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-141 Improper Neutralization of Parameter/Argument Delimiters

Affected Products

Product	Versions
Cisco Unified Computing System (Standalone)Cisco	4.3(1.230097)Affected 4.3(1.230124)Affected 4.3(1.230138)Affected 4.3(2.230207)Affected 4.3(2.230270)Affected 4.3(2.240002)Affected 4.3(3.240022)Affected 4.3(3.240043)Affected 4.3(4.240142)Affected 4.3(4.240152)Affected 4.3(4.242028)Affected 4.3(4.241063)Affected 4.3(4.242038)Affected 4.3(5.240021)Affected 4.3(4.242066)Affected 4.3(5.250001)Affected 4.3(5.250030)Affected 4.3(6.250040)Affected 4.3(5.250033)Affected 4.3(6.250044)Affected 4.3(6.250053)Affected 4.3(4.252001)Affected 4.3(4.252002)Affected 6.0(1.250127)Affected 6.0(1.250131)Affected and 13 more versions

Product

Versions

Cisco Unified Computing System (Standalone)Cisco

4.3(1.230097)Affected
4.3(1.230124)Affected
4.3(1.230138)Affected
4.3(2.230207)Affected
4.3(2.230270)Affected
4.3(2.240002)Affected
4.3(3.240022)Affected
4.3(3.240043)Affected
4.3(4.240142)Affected
4.3(4.240152)Affected
4.3(4.242028)Affected
4.3(4.241063)Affected
4.3(4.242038)Affected
4.3(5.240021)Affected
4.3(4.242066)Affected
4.3(5.250001)Affected
4.3(5.250030)Affected
4.3(6.250040)Affected
4.3(5.250033)Affected
4.3(6.250044)Affected
4.3(6.250053)Affected
4.3(4.252001)Affected
4.3(4.252002)Affected
6.0(1.250127)Affected
6.0(1.250131)Affected
and 13 more versions

References

cisco-sa-cimc-arg-inject-upSHdMfU

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.