Cisco IMC Argument Injection Flaw CVE-2026-20200 Enables Root RCE, PoC Exploit Code Publicly Available

TL;DR

Cisco disclosed two Cisco IMC vulnerabilities in the web-based management interface. The more serious one, CVE-2026-20200, scores 8.8 and allows root-level remote code execution. Cisco confirms that proof-of-concept exploit code is publicly available for it.

Why it matters

The IMC manages Cisco servers at a low level. A root compromise there gives deep control of the hardware. Per Cisco, the flaws could let an attacker “execute arbitrary commands on the underlying operating system” and “elevate privileges to root.”

How the attacks work

Both flaws sit in the IMC web interface. Each needs an authenticated, remote attacker. However, the two issues are independent. One does not require the other to work.

CVE-2026-20200 is an argument injection and RCE flaw. It scores 8.8 and needs only low privileges. CVE-2026-20288 is a separate RCE issue rated 6.5, but it requires high privileges. This report withholds working exploit steps.

Public disclosure and exploit code

Cisco states plainly that “proof-of-concept exploit code is available for CVE-2026-20200.” That public availability raises the urgency for defenders.

Exploitation status

Public proof-of-concept code exists for CVE-2026-20200. However, Cisco “is not aware of any malicious use” of these flaws at this time.

Affected versions

The flaws affect devices running a vulnerable release of Cisco IMC. That includes the 5000 Series ENCS, UCS E-Series, and other UCS-based standalone systems.

Patch and mitigation

There are no workarounds. Cisco urges customers to upgrade to a fixed software release. Apply the vendor updates as soon as possible.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.