Cisco IMC authentication bypass exposure

Cisco released security updates for **Cisco IMC/CIMC** after finding **CVE-2026-20093**, a password-change authentication bypass on **UCS C-Series and E-Series servers**. An unauthenticated attacker can send a crafted HTTP request to the management interface and bypass authentication through the password-change path. Successful exploitation can let the attacker change user passwords, including an **Admin** account, and gain administrative control of the management controller. Cisco says there are **no workarounds** and strongly recommends upgrading to the fixed software as soon as possible. Available evidence does not identify in-the-wild exploitation or a proof-of-concept exploit for the flaw. The current response is straightforward patching of exposed devices, with risk concentrated on management interfaces that remain unpatched and reachable.