CRITICALVulnerability
Verified
Global

NVD Critical: CVE-2026-20093 — A vulnerability in the change password functionality of Cisco Integrated Managem...

Wednesday, April 1, 2026 at 05:28 PM UTC·Source: NIST NVD

Updated: Wednesday, April 1, 2026 at 07:13 PM UTC

Executive Summary

A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.

Analysis

A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the system as Admin. This vulnerability is due to incorrect handling of password change requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user. CVSS Score: 9.8. Published: 2026-04-01T17:28:29.027.

Indicators of Compromise (1)

CVE (1)
CVE-2026-20093
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 1, 2026. Verified by: NIST.

Related Threats

CRITICALRansomware

Cisco fixes critical IMC auth bypass present in many products

Cisco has released patches for a critical vulnerability in its out-of-band management solution, present in many of its servers and appliances. The flaw allows unauthenticated remote attackers to gain admin access to the Cisco Integrated Management Controller (IMC), which gives administrators remote control over servers even when the main OS is shut down. The vulnerability, tracked as CVE-2026-2009

CVE-2026-20093
CSO Online
MEDIUMVulnerability

Geopolitics, AI, and Cybersecurity: Insights From RSAC 2026

AI-driven threats, global leadership shifts, and the future of cybersecurity in a rapidly evolving landscape were among the discussions at RSAC 2026 Conference.

Dark Reading
MEDIUMVulnerability

House Dems decry confirmed ICE usage of Paragon spyware

The trio of Democrats weren’t satisfied with Immigration and Customs Enforcement answers, and criticized the spyware’s use. The post House Dems decry confirmed ICE usage of Paragon spyware appeared first on CyberScoop .

CyberScoop