CVE-2026-20089

A vulnerability in the web-based management interface of Cisco IMC allows an authenticated remote attacker with low privileges to execute arbitrary commands on the underlying operating system and elevate privileges to root. The issue is due to improper validation of user-supplied input.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This is due to improper validation of user-supplied input to the management interface. An attacker could exploit this by sending crafted HTTP requests to an affected device, leading to arbitrary code execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks and execute arbitrary commands as the root user. This is due to improper validation of user-supplied input. An attacker could exploit this by sending crafted commands to the management interface, leading to arbitrary command execution as root. Cisco has assigned a Security Impact Rating of High due to additional security implications after gaining root access.

Vulnerability in the web-based management interface of Cisco IMC allows an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. Due to insufficient input validation. Attacker can persuade a user to click a crafted link, leading to arbitrary script execution in the browser or access to sensitive information.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing arbitrary script execution in the browser or access to sensitive browser-based information.

Vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.

Vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, allowing arbitrary script code execution in the browser or access to sensitive browser-based information.