Command Injection Vulnerability in Cisco IMC Management Interface

CVE-2026-20095

What is CVE-2026-20095?

A command injection vulnerability exists in the web-based management interface of Cisco's Integrated Management Controller (IMC). This flaw allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying operating system as the root user. The root cause is improper validation of user-supplied input, enabling attackers to craft malicious commands that can be sent to the interface. Successful exploitation of this vulnerability could result in significant security implications as the attacker gains complete control over the system.

References