6.5

CVE-2026-20097: cisco cisco unified computing system (standalone) Out-of-bounds Write

CVSS: 6.5v3.1MediumAnalyzed
Published 01-04-2026Last modified 22-04-2026
Open JSON

Vulnerability summary

CVE-2026-20097 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in cisco cisco unified computing system (standalone). EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 01-04-2026
    PublishedVulnerability first disclosed.
  2. 22-04-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user. Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco2 products
  • cisco unified computing system (standalone)4.0(2g) | 3.1(2i) | 3.1(1d) | 4.0(4i) | 4.1(1c) | 4.0(2c) | 4.0(1e) | 4.0(2h) | 4.0(4h) | 4.0(1h) | 4.0(2l) | 3.1(3g) | 4.0(1.240) | 4.0(2f) | 4.0(1g) | 4.0(2i) | 3.1(3i) | 4.0(4d) | 4.1(1d) | 3.1(3c) | 4.0(4k) | 3.1(2d) | 3.1(3a) | 3.1(3j) | 4.0(2d) | 4.1(1f) | 4.0(1c) | 4.0(4f) | 4.0(4c) | 3.1(3d) | 3.1(2g) | 3.1(2c) | 4.0(1d) | 3.1(2e) | 4.0(1a) | 4.0(1b) | 3.1(3b) | 4.0(4b) | 3.1(2b) | 4.0(4e) | 3.1(3h) | 4.0(4l) | 4.1(1g) | 4.1(2a) | 4.0(2n) | 4.1(1h) | 3.1(3k) | 4.1(2b) | 4.0(2o) | 4.0(4m) | 4.1(2d) | 4.1(3b) | 4.0(2p) | 4.1(2e) | 4.1(2f) | 4.0(4n) | 4.0(2q) | 4.1(3c) | 4.0(2r) | 4.1(3d) | 4.1(2g) | 4.1(2h) | 4.1(3f) | 4.1(2j) | 4.1(2k) | 4.1(3h) | 4.2(2a) | 4.1(3i) | 4.2(2f) | 4.2(2g) | 4.2(3b) | 4.1(3l) | 4.2(3d) | 4.3(1.230097) | 4.2(1e) | 4.2(1b) | 4.2(1j) | 4.2(1i) | 4.2(1f) | 4.2(1a) | 4.2(1c) | 4.2(1g) | 4.3(1.230124) | 4.1(2l) | 4.2(3e) | 4.3(1.230138) | 4.2(3g) | 4.3(2.230207) | 4.2(3h) | 4.2(3i) | 4.3(2.230270) | 4.1(3m) | 4.1(2m) | 4.3(2.240002) | 4.3(3.240022) | 4.2(3j) | 4.1(3n) | 4.3(2.240009) | 4.3(3.240043) | 4.3(4.240142) | 4.3(2.240037) | 4.3(2.240053) | 4.3(4.240152) | 4.2(3l) | 4.3(2.240077) | 4.3(4.242028) | 4.3(4.241063) | 4.3(4.242038) | 4.2(3m) | 4.3(2.240090) | 4.3(5.240021) | 4.3(2.240107) | 4.3(4.242066) | 4.2(3n) | 4.3(5.250001) | 4.2(3o) | 4.3(2.250016) | 4.3(2.250021) | 4.3(5.250030) | 4.3(2.250022) | 4.3(6.250040) | 4.3(5.250033) | 4.3(6.250044) | 4.3(6.250053) | 4.3(2.250037) | 4.3(2.250045) | 4.3(4.252001) | 4.3(4.252002) | 6.0(1.250127) | 4.2(3p) | 6.0(1.250131) | 4.3(6.250101) | 6.0(1.250174) | 4.3(6.250117) | 4.3(5.250043) | 4.3(6.250039) | 4.3(5.250045) | 4.3(6.250060) | 6.0(1.250130) | 4.3(4.241014) | 4.3(2.250063) | 6.0(1.250192) | 4.3(6.260003) | 6.0(1.250194)
  • unified_computing_system3.1\(1d\) | 3.1\(2b\) | 3.1\(2c\) | 3.1\(2d\) | 3.1\(2e\) | 3.1\(2g\) | 3.1\(2i\) | 3.1\(3a\) | 3.1\(3b\) | 3.1\(3c\) | 3.1\(3d\) | 3.1\(3g\) | 3.1\(3h\) | 3.1\(3i\) | 3.1\(3j\) | 3.1\(3k\) | 4.0\(1.240\) | 4.0\(1a\) | 4.0\(1b\) | 4.0\(1c\) | 4.0\(1d\) | 4.0\(1e\) | 4.0\(1g\) | 4.0\(1h\) | 4.0\(2c\) | 4.0\(2d\) | 4.0\(2f\) | 4.0\(2g\) | 4.0\(2h\) | 4.0\(2i\) | 4.0\(2l\) | 4.0\(2n\) | 4.0\(2o\) | 4.0\(2p\) | 4.0\(2q\) | 4.0\(2r\) | 4.0\(4b\) | 4.0\(4c\) | 4.0\(4d\) | 4.0\(4e\) | 4.0\(4f\) | 4.0\(4h\) | 4.0\(4i\) | 4.0\(4k\) | 4.0\(4l\) | 4.0\(4m\) | 4.0\(4n\) | 4.1\(1c\) | 4.1\(1d\) | 4.1\(1f\) | 4.1\(1g\) | 4.1\(1h\) | 4.1\(2a\) | 4.1\(2b\) | 4.1\(2d\) | 4.1\(2e\) | 4.1\(2f\) | 4.1\(2g\) | 4.1\(2h\) | 4.1\(2j\) | 4.1\(2k\) | 4.1\(2l\) | 4.1\(2m\) | 4.1\(3b\) | 4.1\(3c\) | 4.1\(3d\) | 4.1\(3f\) | 4.1\(3h\) | 4.1\(3i\) | 4.1\(3l\) | 4.1\(3m\) | 4.1\(3n\) | 4.2\(1a\) | 4.2\(1b\) | 4.2\(1c\) | 4.2\(1e\) | 4.2\(1f\) | 4.2\(1g\) | 4.2\(1i\) | 4.2\(1j\) | 4.2\(2a\) | 4.2\(2f\) | 4.2\(2g\) | 4.2\(3b\) | 4.2\(3d\) | 4.2\(3e\) | 4.2\(3g\) | 4.2\(3h\) | 4.2\(3i\) | 4.2\(3j\) | 4.2\(3l\) | 4.2\(3m\) | 4.2\(3n\) | 4.2\(3o\) | 4.2\(3p\) | 4.3\(1.230097\) | 4.3\(1.230124\) | 4.3\(1.230138\) | 4.3\(2.230207\) | 4.3\(2.230270\) | 4.3\(2.240002\) | 4.3\(2.240009\) | 4.3\(2.240037\) | 4.3\(2.240053\) | 4.3\(2.240077\) | 4.3\(2.240090\) | 4.3\(2.240107\) | 4.3\(2.250016\) | 4.3\(2.250021\) | 4.3\(2.250022\) | 4.3\(2.250037\) | 4.3\(2.250045\) | 4.3\(2.250063\) | 4.3\(3.240022\) | 4.3\(3.240043\) | 4.3\(4.240142\) | 4.3\(4.240152\) | 4.3\(4.241014\) | 4.3\(4.241063\) | 4.3\(4.242028\) | 4.3\(4.242038\) | 4.3\(4.242066\) | 4.3\(4.252001\) | 4.3\(4.252002\) | 4.3\(5.240021\) | 4.3\(5.250001\) | 4.3\(5.250030\) | 4.3\(5.250033\) | 4.3\(5.250043\) | 4.3\(5.250045\) | 4.3\(6.250039\) | 4.3\(6.250040\) | 4.3\(6.250044\) | 4.3\(6.250053\) | 4.3\(6.250060\) | 4.3\(6.250101\) | 4.3\(6.250117\) | 4.3\(6.260003\) | 6.0\(1.250127\) | 6.0\(1.250130\) | 6.0\(1.250131\) | 6.0\(1.250174\) | 6.0\(1.250192\) | 6.0\(1.250194\)

1 vendor · 2 products

References

1 links