Vulnerabilities fixed in Cisco Integrated Management Controller

🗓️ 03 Apr 2026 10:34:46Reported by NCSCType

ncsc

ncsc🔗 advisories.ncsc.nl👁 7 Views

Cisco IMC interface fixes authentication bypass, command injection, and cross-site scripting.

Reporter	Title	Published	Views	Family All 106
BDU FSTEC	The vulnerability of the password change function in the Cisco Integrated Management Controller (IMC) allows a hacker to bypass existing security mechanisms and elevate their privileges to an admin level.	3 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of data cleaning at the management level. This allows attackers to execute arbitrary commands with root privileges.	3 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of data cleaning at the management level. This allows attackers to execute arbitrary commands with root privileges.	3 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of data cleaning at the management level. This allows attackers to execute arbitrary commands with root privileges.	3 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, relates to writing beyond the buffer boundaries, allowing an attacker to execute arbitrary code with root privileges.	3 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of protective measures for the website structure. This allows attackers to perform cross-site scripting attacks (XSS).	8 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks (XSS).	8 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks (XSS).	8 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks (XSS).	8 Apr 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Cisco Integrated Management Controller, a software tool for remote server management, arises from the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks (XSS).	8 Apr 202600:00	–	bdu_fstec

Source	Link
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-ssh-priv-esc-2mZDtdjM

03 Apr 2026 10:34Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.8

EPSS0.01094

SSVC

authentication bypass command injection cross site scripting privilege escalation remote attacker management interface updates released