CVE-2026-20093: Unauthenticated Admin Reset on Cisco IMC

Executive Summary

CVE-2026-20093 is a pre-auth password-change bypass in Cisco Integrated Management Controller. CWE-20. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Cisco published the advisory on 1 April 2026. Credit: researcher jyh. A crafted HTTP POST to the XML API, method configConfMo, object class aaaUser, is processed before the session is checked. The attacker sets any user’s password, including Admin, then logs in as that user. There is no configuration workaround. Isolation or patch.

The lab notes walk Host Upgrade Utility ISOs for UCS C240 M5: 4.3.2.250063 (vulnerable, listed as affected 4.3(2.250063) on the CVE record) versus 4.3.2.260007 (Cisco’s first fixed M5 release 4.3(2.260007)). The XML path is nginx location ~* nuova$ → FastCGI fcgi_main_handler → libxapiserver.so → xapireqproc / manageUsers. This draft keeps those commands and dumps, then adds the kitchen picture of a BMC that never sleeps, CyCognito’s exposure chart, the full Cisco product and fix tables, and why host EDR is irrelevant once you own the lights-out controller.

A successful exploit could allow the attacker to bypass authentication, alter the passwords of any user on the system, including an Admin user, and gain access to the system as that user.

Cisco PSIRT, 1 April 2026

The Second Computer in the Chassis

IMC is Cisco’s BMC: its own ARM Linux, its own NIC, its own web UI and XML API, alive when the host OS is off. KVM, virtual media, BIOS, power. EDR, SIEM agents, disk encryption on the host do not see it. If the management port is on a VLAN a stranger can reach, CVE-2026-20093 is a network-adjacent Admin reset with no user click.

What Public Sources Agree On

Cisco: incorrect handling of password-change requests; crafted HTTP; unauthenticated remote Admin. No workarounds. PSIRT not aware of public exploits or malicious use at publication. CyCognito (Igal Zeifman, 5 April 2026) names the XML API details that match the lab mapping: POST targeting configConfMo on aaaUser, authorization skipped before session context. One packet, then you authenticate with the password you just set.

CyCognito’s sector split is a scan of what they can see, not a census of all UCS. It still matches the operational fact: IMC ports linger on management VLANs that got flattened, in colo cages, on appliances people forgot were UCS under the skin.

Affected Hardware (Cisco)

Vulnerable if running a listed IMC release, regardless of configuration:

• 5000 Series ENCS (CSCwq55648)
• Catalyst 8300 Series Edge uCPE (CSCwq68912)
• UCS C-Series M5 and M6 rack servers in standalone mode (CSCwq55659)
• UCS E-Series M3 and M6

Also: any Cisco appliance on a preconfigured UCS C-Series that exposes the IMC UI, including APIC, BE6K/BE7K, Catalyst Center, CSP 5000, CSPC, CMX, Cyber Vision, Expressway, HyperFlex Edge / DC-No-FI, IEC6400, XRv 9000, Meeting Server 1000, Nexus Dashboard, Prime Infrastructure / PNR Jumpstart, Secure Endpoint Private Cloud, Secure Firewall Management Center, Secure Malware Analytics, Secure Network Analytics, SNS, Secure Workload, Telemetry Broker, Connected Safety UCS, and more in the advisory.

Not affected (Cisco): UCS B-Series blades, C-Series M7/M8 standalone, C-Series with Fabric Interconnects in UCS Manager or Intersight Managed Mode, S-Series, X-Series, Unified Edge.

Fixed Releases

The lab pair is exactly the M5 row: HUU ucs-c240m5-huu-4.3.2.250063.iso versus ucs-c240m5-huu-4.3.2.260007.iso.

Lab: Pulling the IMC Rootfs out of HUU

Mount the ISO, take cimc.bin, binwalk, carve the squashfs at 0xF80A00, unsquash. Commands from the notes:

ls
ucs-c240m5-huu-4.3.2.250063.iso  ucs-c240m5-huu-4.3.2.260007.iso

sudo mount -o loop ucs-c240m5-huu-4.3.2.250063.iso /mnt
mount: /mnt: WARNING: source write-protected, mounted read-only.

ls c240m5_firmware_cimc_4.3.2.250063/firmware/cimc/
cimc.bin

binwalk cimc.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
245224        0x3BDE8         CRC32 polynomial table, little endian
280892        0x4493C         Unix path: /dev/mtd3/boot.conf not found. Booting secure u-boot
282165        0x44E35         Unix path: /dev/mtd2/boot.conf not found. Booting Linux1
297300        0x48954         JFFS2 filesystem, little endian
303122        0x4A012         JBOOT STAG header, image id: 0, timestamp 0x178A00, image size: 724041728 bytes, image JBOOT checksum: 0x8A00, header JBOOT checksum: 0x17
315882        0x4D1EA         JBOOT STAG header, image id: 0, timestamp 0x178A02, image size: 724041728 bytes, image JBOOT checksum: 0x8A02, header JBOOT checksum: 0x17
329723        0x507FB         LZMA compressed data, properties: 0x8A, dictionary size: 0 bytes, uncompressed size: 65552 bytes
526848        0x80A00         uImage header, header size: 64 bytes, header CRC: 0xD1BB6ADB, created: 2025-12-12 04:52:32, image size: 12617738 bytes, Data Address: 0x81008000, Entry Point: 0x81008000, data CRC: 0x4FD9F2DC, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-5.15.92.2"
526912        0x80A40         Linux kernel ARM boot executable zImage (little-endian)
16255488      0xF80A00        Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 42400906 bytes, 11756 inodes, blocksize: 131072 bytes, created: 2025-12-12 04:52:34
58659328      0x37F1200       Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 10096940 bytes, 754 inodes, blocksize: 131072 bytes, created: 2025-10-08 15:01:45

dd if=cimc.bin of=main_rootfs.squashfs bs=1 skip=16255488
52508672+0 records in
52508672+0 records out
52508672 bytes (53 MB, 50 MiB) copied, 151.017 s, 348 kB/s

unsquashfs main_rootfs.squashfs
created 10052 files
created 1475 directories

cd squashfs-root/
ls
bin  cisco  debug  etc  lib  nuova  nv  opt  sbin  usr  var

Kernel string: Linux 5.15.92.2 on ARM. Directory nuova is the old UCS XML namespace. That name is still the FastCGI location.

Diff the Two Rootfs, Then Hunt configConfMo

Ignore www static assets. The interesting deltas:

diff -rq ~/c240m5_firmware_cimc_4.3.2.250063/firmware/cimc/squashfs-root/ \
        ~/c240m5_firmware_cimc_4.3.2.260007/firmware/cimc/squashfs-root/ > ~/diff.txt

grep "differ" ~/diff.txt | awk '{print $2}' | sed "s|.*squashfs-root/||" \
  | grep -v -E "\.(js|css|png|gif|jpg|jpeg|html|htm|txt|json|md)$|/usr/local/www/"

Among the binaries that change: xapireqproc, fcgi_main_handler, libxapiserver.so, plus a pile of curl-using shell scripts. Grep for the API verb:

grep -l "configConfMo" sbin/alertmgr usr/local/bin/dataserver usr/local/bin/event_manager \
  usr/local/bin/fcgi_main_handler usr/local/bin/information-logger usr/local/bin/inventoryengine \
  usr/local/bin/mcclient usr/local/bin/nvmed usr/local/bin/rack_monitor usr/local/bin/redfish/credfish \
  usr/local/bin/storaged usr/local/bin/xapireqproc usr/local/lib/appweb/*.so usr/local/lib/libjolt_*.so 2>/dev/null
usr/local/bin/fcgi_main_handler
usr/local/bin/xapireqproc
usr/local/lib/appweb/libxapiserver.so

1. usr/local/bin/fcgi_main_handler — transport gateway (FastCGI)
2. usr/local/lib/appweb/libxapiserver.so — XML API business logic
3. usr/local/bin/xapireqproc — request processor / manageUsers

nginx Hands /nuova to FastCGI

# ./usr/local/nginx/conf/nginx.conf.template
        # xapi handling
        location ~* nuova$ {
           root           /usr/local/www/;
           fastcgi_buffering off;
           fastcgi_pass   unix:/var/run/myfcgiserver.sock;
           fastcgi_param  SCRIPT_FILENAME /usr/local/www$fastcgi_script_name;
           fastcgi_param  REQUEST_URI /nuova;
           include        fastcgi_params;
           # 2139999 seconds is 24 days
           fastcgi_read_timeout  2139999;
        }

The socket is owned by fcgi_main_handler (/var/service/fcgi_main_handler/run, etc/init.d/fcgid.init). xapid kills stale xapireqproc. A 24-day FastCGI read timeout is a BMC that expects KVM sessions to last forever.

grep -rn "myfcgiserver" ./usr/local/bin
grep: ./usr/local/bin/fcgi_main_handler: binary file matches

./etc/init.d/xapid:122:                echo 'spids=`pidof xapireqproc`' >> ${SVCDIR}/run
./var/service/fcgi_main_handler/run:2:exec /usr/local/bin/fcgi_main_handler 1> /dev/null 2> /dev/null

aaaUser in the UCS Mapping

grep -rnw aaaUser ./usr/local/etc/xapiserver/ucsm_mapping.xml
1887:<aaaUser/>
1921:<aaaUser concrete="yes" parent="aaaSystemUser" rn="user-" mitpath="sys/user-ext/user-?0" namingProperty="id" containerClass="aaaUserEp" access="rw" singleton="no" preXPath="//user" preXPathSI="//user[id = '?0']" gds="users" setApi="manageUsers">
1933:</aaaUser>

access="rw", setApi="manageUsers". Grep confirms manageUsers lives in xapireqproc; configConfMo in all three of handler, xapireqproc, libxapiserver. That is the public configConfMo / aaaUser sentence, grounded in the firmware XML rather than in a rumour.

grep -l "manageUsers" usr/local/bin/fcgi_main_handler usr/local/bin/xapireqproc usr/local/lib/appweb/libxapiserver.so
usr/local/bin/xapireqproc

grep -l "aaaUser" usr/local/bin/fcgi_main_handler usr/local/bin/xapireqproc usr/local/lib/appweb/libxapiserver.so
usr/local/bin/xapireqproc
usr/local/lib/appweb/libxapiserver.so

The Other Diff: curl argv, Not the Auth Bypass

4.3.2.260007 also rewrites external-cert-key-upload.sh so curl gets -u and the credential string as separate arguments. That is the CIMC command-injection class (allow-list, system(), CVE-2024-20356 family), not CVE-2026-20093. One HUU ISO carries more than one fix. Do not confuse them when you bisect.

-        CREDENTIALS="-u $username:$password"
+        CREDENTIALS_OPTION="-u"
+        CREDENTIALS="$username:$password"
...
-       curl -s -o $uploadTmpFile $protocol://$remoteServer/$FilePath \
-           $CREDENTIALS ${CURL_OPT};
+            curl -s -o "$uploadTmpFile" "${protocol}://${remoteServer}/${FilePath}" \
+                $CREDENTIALS_OPTION "${CREDENTIALS}" ${CURL_OPT};

After You Are Admin on the BMC

• Virtual media: mount an ISO, reboot, install a hypervisor or implant the host disk.
• Serial-over-LAN / KVM: capture boot, reset BIOS passwords, toggle Secure Boot if the BMC is trusted to own the keys (see also the older CIMC jailbreak-to-DOOM class).
• Power: reset, persistent off, firmware update.
• Persistence below the OS: survives reimage of the host if you can write BMC storage.
• Lateral: other IMC addresses on the same lights-out VLAN.

ATT&CK: T1190 (exploit public-facing app) if IMC is reachable; T1098 (account manipulation) for the password set; T1542 (pre-OS boot) / T1495 (firmware) once you have KVM and updates. CWE-20 as catalogued; practically CWE-287 (improper authentication) as well.

Finding Exposed IMC

• TCP 443/80 with Cisco IMC / Apache-Coyote / nginx titles, Redfish /redfish/v1, XML POST to /nuova.
• TLS certs with Cisco IMC / UCS in SAN.
• runZero / CyCognito / Shodan queries for IMC; then prove version against HUU/CIMC strings, not against a banner that lies.
• Do not version-scan with a password-change POST.

Appliances That Need a Named ISO, Not a Generic HUU

Cisco’s advisory is explicit: some skins on UCS C-Series cannot just run the C240 HUU you downloaded for a lab. If you patch “the server” and leave FMC/SNA/SMA/ISE SNS on old IMC, you did not patch the estate.

The Neighbour CVEs in the Same Week

Help Net Security counted ten IMC flaws in the April 2026 drop. CVE-2026-20093 is the unauthenticated one. The others still matter once you have a session, or if you phish an admin:

• CVE-2026-20085, 20087–20090 — XSS in the web UI (mostly authenticated, click a link).
• CVE-2026-20094–20097 — authenticated RCE / command execution to root on the IMC OS. That is the step after 20093: reset Admin, then root the BMC Linux we unsquashed.

If you only patch “the 9.8” and leave 20094–20097, a stolen cookie still becomes root on the night manager. Patch the whole IMC train.

Why standalone vs Fabric Interconnect matters

Behind UCS Manager or Intersight, the C-Series BMC is not the same XML front door. Cisco carved those out. Standalone is the lonely rack server, the colo box, the “security appliance” that still runs CIMC on a dedicated NIC. That is the lab C240. That is also the thing Shodan finds when someone NAT’d TCP/443 for “remote KVM.”

Redfish is not the bug, and not a workaround

IMC speaks Redfish too. CVE-2026-20093 is described on the XML password-change path, not as a Redfish-only issue. Closing /nuova in nginx without a Cisco-supported mode is an untested workaround; Cisco said there are none. Do not invent a local nginx deny and call it remediated. Upgrade firmware.

What “no public PoC” Does Not Mean

PSIRT’s line is: they were not aware of public write-ups or malicious use on 1 April 2026. CyCognito repeated that. Method names (configConfMo, aaaUser) were already in the mapping XML of every IMC rootfs. Anyone who has automated UCS XML clients can guess the shape. Treat reachable unpatched IMC as compromised-capable, not as “safe until GitHub.” Rotate passwords after you patch if the port was ever on a shared VLAN.

Key Takeaways

• CVE-2026-20093 is unauthenticated Admin password reset on Cisco IMC. CVSS 9.8. No workaround.
• The desk is /nuova. The verb is configConfMo. The object is aaaUser / manageUsers.
• Standalone C-Series M5/M6 and a long list of UCS-based appliances. Blades behind FI / M7 / M8 are out.
• M5 fix is 4.3(2.260007) — the second ISO in the lab.
• Host EDR does not see BMC. Segment lights-out or you are one POST from KVM.
• The curl -u split in the same ISO is a different bug class. Bisect honestly.

Defensive Recommendations

1. Patch IMC/HUU/NFVIS to the table above. Appliances often need a named ISO (FMC Hotfix FX, SNA firmware patch, SMA OOB ISO).
2. Put every IMC on an isolated management VLAN. No default route to the internet. Jump host + MFA.
3. Inventory UCS-based appliances by serial and CIMC version, not by product marketing name.
4. Alert on password-change events on IMC outside a change window, and on new aaaUser objects.
5. If you cannot patch this week, unplug the BMC NIC from untrusted L2. Cisco says that is not a workaround; it is still better than 9.8 on the WAN.
6. After patch, rotate Admin and all local IMC users. Assume pre-patch exposure if the port was reachable.
7. Do not test the bypass on systems you do not own.

Conclusion

jyh reported a password-change path that did not ask who you were. Cisco shipped 4.3(2.260007) and cousins. The lab notes show the same story in squashfs: nuova, FastCGI, aaaUser, manageUsers, three binaries that still contain configConfMo. The BMC will still answer the phone when the host is off. Make sure the phone is on a desk only you can reach, and that the firmware is the one that finally checks caller ID.

Original lab commands: CIMC.md (4.3.2.250063 vs 4.3.2.260007). Advisory: cisco-sa-cimc-auth-bypass-AgG2BxTn. Exposure write-up: “Emerging Threat: CVE-2026-20093” by Igal Zeifman at CyCognito.