Vulnerabilities · 180 days ago

Cisco IMC Command Injection Lets Read-Only Users Execute as Root

Cisco Integrated Management Controller (IMC) has three separate command injection vulnerabilities (CVE-2026-20094, CVE-2026-20095, CVE-2026-20096) in its web-based management interface. These flaws allow authenticated attackers, including those with only read-only access, to execute arbitrary commands as the root user on the underlying operating system.

This elevates the risk because limiting user roles does not prevent full system compromise. There are no workarounds; only Cisco's software updates fix the issue. Organizations with IMC exposed to administrative networks or third-party access face heightened risk and must prioritize patching immediately.

Timeline

• Apr 2 Reported by The Hacker News
• Apr 2 Reported by Cisco PSIRT

Sources

3 sources covering this story

• The Hacker News Apr 2

  Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise

  Cisco patches two 9.8 CVSS flaws (CVE-2026-20093, CVE-2026-20160), preventing authentication bypass and root access.

• SecurityWeek Apr 2

  Cisco Patches Critical and High-Severity Vulnerabilities

  The bugs could lead to authentication bypass, remote code execution, information disclosure, and privilege escalation.

• Cisco PSIRT Apr 2

  Cisco Security Advisory: Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability

  A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker with low privileges to access sensitive information that they are not authorized to access.

• Cisco PSIRT Apr 1

  Cisco Security Advisory: Cisco Integrated Management Controller Cross-Site Scripting Vulnerabilities

  Multiple vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

• Cisco PSIRT Apr 1

  Cisco Security Advisory: Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities

  Multiple vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to execute arbitrary code or commands on the underlying operating system of an affected system and elevate privileges to root.

Entities

• CVE-2026-20094
• CVE-2026-20095
• CVE-2026-20096

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-04-03

Editions

• Briefing for 2026-04-03

Related stories

• Next.js React2Shell Exploit Automates AI and Cloud Credential Theft
• TrueConf Update Flaw Lets Attackers Reach Isolated Government Networks
• Active Dawn Zero-Day in Chrome Enables Sandbox Escape