CVE-2026-20093: Critical Cisco IMC Flaw Allows Unauthenticated Admin Access to UCS Servers

CVE-2026-20093 is a critical (CVSS 9.8) authentication-bypass vulnerability in Cisco IMC’s password-change functionality that allows unauthenticated remote attackers to reset credentials and obtain full administrative control of affected UCS C- and E-Series servers and dozens of appliances built on them. The advisory lists affected hardware and fixed IMC/NFVIS releases, describes exploitation via a crafted HTTP POST, notes no evidence of in-the-wild exploitation or public PoC, and recommends immediate patching, management-plane isolation, jump hosts with MFA, SIEM monitoring for password-change requests, and user audits.