Cisco IMC Critical Vulnerabilities - Remote Code Execution and Privilege Escalation
Summary
CERT-Bund issued a critical security advisory (WID-SEC-2026-0953) disclosing multiple vulnerabilities in Cisco Integrated Management Controller (IMC) affecting UCS C-Series, E-Series, and S-Series servers. The vulnerabilities carry a CVSS Base Score of 9.8, enabling remote unauthenticated attackers to gain administrator privileges, execute arbitrary code with root privileges, and conduct cross-site-scripting attacks. Organizations using affected Cisco products should apply patches immediately.
What changed
CERT-Bund disclosed critical vulnerabilities in Cisco Integrated Management Controller spanning multiple product lines including UCS C-Series M5/M6, UCS E-Series M3/M6, UCS S-Series Storage Server, 5000 Series ENCS NFVIS, and Catalyst 8300 Series Edge uCPE NFVIS. The CVSS Base Score of 9.8 indicates critical severity; the CVSS Temporal Score is 8.5. Affected versions fall below specific patch thresholds depending on product line. The vulnerabilities allow remote attackers to achieve administrator access, execute code with root privileges, and perform XSS attacks.
Organizations must immediately identify deployed Cisco IMC instances and determine which product versions are in use. Apply the latest security patches from Cisco (versions 4.3(2.260007), 6.0(1.250174), 6.0(2.260044), 3.2.17, 4.15.3, 4.15.5, 4.18.3, or 4.3(6.260017) depending on platform). Until patches are applied, restrict network access to the IMC management interface and monitor for indicators of compromise. No specific compliance deadline was stated; however, immediate action is warranted given the critical severity and remote attack vector.
What to do next
- Identify all deployed Cisco IMC instances and inventory affected product versions
- Apply Cisco security patches for affected product lines immediately
- Restrict network access to IMC management interfaces and monitor for exploitation attempts
Source document (simplified)
[WID-SEC-2026-0953] Cisco Integrated Management Controller: Mehrere Schwachstellen CVSS Base Score 9.8 (kritisch) CVSS Temporal Score 8.5 (hoch) Remoteangriff ja Datum 01.04.2026 Stand 02.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- CISCO Appliance
- Hardware Appliance
Produktbeschreibung
Der Cisco Integrated Management Controller ist eine Serververwaltung für mehrere Cisco-Produkte.
Produkte
01.04.2026
- Cisco Integrated Management Controller UCS C-Series M5 Rack ServerIMC <4.3(2.260007)
Cisco Integrated Management Controller UCS C-Series M6 Rack Server IMC <4.3(2.260007)
Cisco Integrated Management Controller UCS C-Series M6 Rack Server IMC <6.0(1.250174)
Cisco Integrated Management Controller UCS E-Series M3 IMC <3.2.17
Cisco Integrated Management Controller UCS E-Series M6 IMC <4.15.3
Cisco Integrated Management Controller Hardware Platform
Cisco Integrated Management Controller 5000 Series ENCS NFVIS <4.15.5
Cisco Integrated Management Controller Catalyst 8300 Series Edge uCPE NFVIS <4.18.3
Cisco Integrated Management Controller UCS C-Series M6 Rack Server IMC <6.0(2.260044)
Cisco Integrated Management Controller UCS S-Series Storage Server IMC <4.3(6.260017)
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in Cisco Integrated Management Controller ausnutzen, um Administratorrechte zu erlangen, beliebigen Code mit Root-Rechten auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.