cisco unified computing system vulnerabilities

Latest cisco unified computing system CVEs

Newest publication first · page 1 of 5

1. CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.18%

   A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker wit...

2. CVE-2026-20288 Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability

   Published 2026-08-05

   Medium·CVSS 6.5 EPSS 0.64%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due...

3. CVE-2026-20200 Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability

   Published 2026-08-05

   High·CVSS 8.8 EPSS 0.73%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to...

4. CVE-2026-20090 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

   Published 2026-04-01

   Medium·CVSS 4.8 EPSS 0.25%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An a...

5. CVE-2026-20089 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

   Published 2026-04-01

   Medium·CVSS 4.8 EPSS 0.25%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An a...

6. CVE-2026-20087 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

   Published 2026-04-01

   Medium·CVSS 4.8 EPSS 0.18%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An a...

7. CVE-2026-20088 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

   Published 2026-04-01

   Medium·CVSS 4.8 EPSS 0.23%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An a...

8. CVE-2026-20096 Cisco Integrated Management Controller Command Injection Vulnerability

   Published 2026-04-01

   Medium·CVSS 6.5 EPSS 0.73%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to im...

9. CVE-2026-20097 Cisco Integrated Management Controller Remote Code Execution Vulnerability

   Published 2026-04-01

   Medium·CVSS 6.5 EPSS 0.41%

   A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based manage...

10. CVE-2026-20094 Cisco Integrated Management Controller Command Injection Vulnerability

    Published 2026-04-01

    High·CVSS 8.8 EPSS 1.1%

    A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to impr...

11. CVE-2026-20095 Cisco Integrated Management Controller Command Injection Vulnerability

    Published 2026-04-01

    Medium·CVSS 6.5 EPSS 0.95%

    A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system and execute arbitrary commands as the root user. This vulnerability is due to im...

12. CVE-2026-20085 Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

    Published 2026-04-01

    Medium·CVSS 6.1 EPSS 0.19%

    A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this...

13. CVE-2020-26062 Cisco Integrated Management Controller Username Enumeration Vulnerability

    Published 2024-11-18

    Medium·CVSS 5.3 EPSS 0.84%

    A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of...

14. CVE-2020-26063 Cisco Integrated Management Controller Software Authorization Bypass Vulnerability

    Published 2024-11-18

    Medium·CVSS 5.4 EPSS 0.62%

    A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API end...

15. CVE-2024-20365 Cisco Integrated Management Controller Redfish Command Injection Vulnerability

    Published 2024-10-02

    High·CVSS 7.2 EPSS 0.89%

    A vulnerability in the Redfish API of Cisco UCS B-Series, Cisco UCS Managed C-Series, and Cisco UCS X-Series Servers could allow an authenticated, remote attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to r...

16. CVE-2024-20295 A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and....

    Published 2024-04-24

    High·CVSS 8.8 EPSS 1.6%

    A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must hav...

17. CVE-2024-20356 A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform comma...

    Published 2024-04-24

    High·CVSS 8.7 EPSS 29.6%

    A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform command injection attacks on an affected system and elevate their privileges to root....

18. CVE-2024-20294 A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS)...

    Published 2024-02-28

    Medium·CVSS 6.6 EPSS 0.32%

    A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling...

19. CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Published 2021-12-10

    Critical·CVSS 10.0 EPSS 100.0% CISA KEV added 2021-12-10 Ransomware Exploited in the wild Framework module Public exploit PoC

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messa...

20. CVE-2021-34736 Cisco Integrated Management Controller GUI Denial of Service Vulnerability

    Published 2021-10-21

    High·CVSS 7.5 EPSS 1.3%

    A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to cause the web-based management interface to unexpectedly restart. The vulnerability is due to insufficient input valid...

21. CVE-2021-1592 Cisco UCS Manager Software SSH Sessions Denial of Service Vulnerability

    Published 2021-08-25

    Medium·CVSS 4.3 EPSS 1.0%

    A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management for established SSH sessions. An...

22. CVE-2021-1590 Cisco NX-OS Software system login block-for Denial of Service Vulnerability

    Published 2021-08-25

    Medium·CVSS 5.3 EPSS 1.4%

    A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition. This vulnerability is due to a logic...

23. CVE-2021-1387 Cisco NX-OS Software IPv6 Netstack Denial of Service Vulnerability

    Published 2021-02-24

    High·CVSS 8.6 EPSS 1.4%

    A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because the software improperly releases resources when it processes certain...

24. CVE-2021-1368 Cisco FXOS and NX-OS Software Unidirectional Link Detection Denial of Service and Arbitrary Code Execution Vulnerability

    Published 2021-02-24

    High·CVSS 8.8 EPSS 0.46%

    A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affect...

25. CVE-2019-1736 Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability

    Published 2020-09-23

    Medium·CVSS 6.6 EPSS 0.25%

    A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface (UEFI) Secure Boot validation checks and load a compromised software image on an affected device. The vulnerabili...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.