Privilege Escalation in Cisco UCS Manager Software
CVE-2026-20037

4.4MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Unified Computing System (managed)
Vendor
CVE Published:
25 February 2026

Badges

👾 Exploit Exists

What is CVE-2026-20037?

A vulnerability in the Cisco UCS Manager Software enables authenticated users with read-only privileges to exploit unnecessary permissions, allowing them to modify files and execute unauthorized actions within the system. Attackers can authenticate as read-only users to access the NX-OS CLI, potentially creating or overwriting files in the file system. This situation poses a risk of limited privileged actions being executed on the affected devices, thereby compromising system integrity.

Affected Version(s)

Cisco Unified Computing System (Managed) 4.0(4c)

Cisco Unified Computing System (Managed) 4.0(2b)

Cisco Unified Computing System (Managed) 4.1(2a)

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.