Cisco resolved a critical security flaw in its Integrated Management Controller (IMC) that permitted attackers to run commands as root via the controller’s web interface. The vulnerability, tracked as CVE-2026-20200 with a severity score of 9.8, was addressed in the company’s August 5 security updates.
A proof-of-concept exploit named CIMCown appeared on GitHub following the disclosure. Christoph Peil of German security firm NSIDE ATTACK LOGIC discovered the vulnerability during a commissioned security assessment.
How the vulnerability works
The flaw targets the web-based management interface of Cisco IMC, which administrators use to oversee UCS C-Series rack servers and S-Series storage servers. Cisco’s advisory explained that improper validation of user-supplied input created the opening for exploitation.
An authenticated, remote attacker with low privileges could send crafted inputs to the interface. A successful exploit would allow the attacker to execute arbitrary commands on the underlying operating system as the root user. Cisco provided no workarounds, advising customers to apply the patch immediately.
The issue affects UCS C-Series M7 and M8 Rack Servers in standalone mode, as well as several Cisco appliances built on these server platforms. Peil noted that compromising the IMC provides attackers with deep, persistent control that evades detection by standard security tools like endpoint monitoring systems.
Related: Open-Source Platform Enables Self-Improving AI Agents
The IMC operates as a control layer beneath the main operating system, handling tasks such as BIOS updates, Secure Boot configuration, and direct OS interactions. Peil described it as “an operating system for the operating system.” Exploitation would allow attackers to seize control of the server and any applications running on it.
This access level makes the flaw particularly risky for data centers, where IMC manages essential infrastructure. Without workarounds, administrators must either patch immediately or disable the web interface to prevent attacks.
For organizations unable to patch right away, Peil recommended disabling the IMC web interface to block the affected attack path.
The August 5 advisory also included fixes for other critical vulnerabilities in IOS XE and Catalyst SD-WAN. Those issues, discovered internally with AI assistance, have not been exploited in the wild. Unlike CVE-2026-20200, they were grouped by their underlying Common Weakness Enumeration (CWE) categories and assigned collective identifiers.
The IMC flaw remains the most pressing update in the batch due to its severity score of 9.8 and the immediate risk from the public exploit. Administrators managing affected Cisco hardware should prioritize these patches to prevent potential breaches.
