CVE-2026-20093: Cisco IMC Authentication Bypass in Change Password Function
CVE-2026-20093 is a critical authentication bypass in the change password functionality of Cisco Integrated Management Controller (IMC), rated 9.8 under CVSS 3.1 by the CNA. The record describes an unauthenticated remote attacker gaining Admin-level access by abusing incorrect handling of password change requests. The record shows no affected versions, fixed releases, or KEV listing, so the vendor advisory is the primary source for remediation.
Overview
CVE-2026-20093 affects the change password functionality of Cisco Integrated Management Controller (IMC). According to the record, the flaw stems from incorrect handling of password change requests, which lets an unauthenticated remote attacker bypass authentication. The CNA, Cisco PSIRT, published the entry on 2026-04-01 and linked its advisory in the references.
Impact
The description states that a successful attack could let an attacker alter the passwords of any user on the system, including an Admin user, and then access the system as that user. The CNA assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to network access, no privileges, no user interaction, and high confidentiality, integrity and availability impact. The weakness is classified as CWE-20, Improper Input Validation.
Affected products and versions
- Product: Cisco Integrated Management Controller (IMC).
- Affected versions: not listed in the record (the affected list is empty).
- Fixed versions: not listed in the record (the fixes list is empty). The absence of fixed versions in this record does not mean no fix exists; consult the Cisco advisory for release information.
Exploitation status
The KEV catalog entry is not listed in the record, so no confirmed active exploitation is recorded in the sources consulted. The EPSS probability is 0.00991 with a percentile of 0.61566 as recorded, which is a statistical estimate of exploitation likelihood and not evidence of exploitation.
Remediation and mitigation
- Review the Cisco security advisory linked in the references and identify whether your IMC deployments fall within the affected scope.
- Apply the vendor-provided updates for affected IMC releases as soon as they can be validated in your environment.
- Until patching is complete, limit access to IMC management interfaces to trusted administrative networks and jump hosts, and avoid exposing them to the internet.
- Rotate credentials for administrative accounts on affected devices after patching, if there is any indication of unauthorized access.
Detection guidance
- Review IMC and management system logs for unexpected password changes, especially for Admin or other privileged accounts.
- Look for administrative logins or sessions that do not match known operator activity or originate from unexpected addresses.
- Monitor network traffic to management interfaces for unusual HTTP activity from untrusted sources.
Limitations of the available information
The record does not provide affected or fixed version ranges, product-specific configuration conditions, vendor-supplied workarounds beyond the advisory link, or any exploitation reports. These details must be verified directly in the Cisco advisory before making remediation decisions.
Frequently asked questions
What is CVE-2026-20093?
It is a critical vulnerability in the change password functionality of Cisco Integrated Management Controller that can let an unauthenticated remote attacker bypass authentication and gain Admin-level access, according to the record.
Is CVE-2026-20093 known to be actively exploited?
The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.