CVE-2026-20200
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 5.71%
- CWE
- CWE-141
- Published
- 2026-08-05
- Last modified
- 2026-08-06
Affected products
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
- Cisco Cisco Unified Computing System (Standalone)
Weakness type
Related vulnerabilities
- CVE-2026-66323 — Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-19594 — Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation
- CVE-2026-56813 — Cookie attribute injection in Plug.Conn.Cookies.encode/2
- CVE-2025-20338 — A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker...
- CVE-2025-31329 — Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2024-0840 — Grandstream UCM Series IP PBX HTTP Parameter Injection
- CVE-2022-41665 — A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10),...
- CVE-2022-29873 — A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not...