GCVE-110-NCSC-2026-106

Advisory PublishedCVSS 9.8/10

Vulnetix · Advisory published April 3, 2026

A vulnerability in Cisco Integrated Management Controller's password change feature allows unauthenticated remote attackers to bypass authentication and gain administrative access via crafted HTTP requests.

Download JSON Open in Console

Weaknesses (CWE)

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')CWE-787Out-of-bounds WriteCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Risk Scores

CVSS 3.1

9.8/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Cisco	vers:unknown/*	—	—

Aliases

CVE-2026-20085 CVE-2026-20087 CVE-2026-20088 CVE-2026-20089 CVE-2026-20090 CVE-2026-20093 CVE-2026-20094 CVE-2026-20095 CVE-2026-20096 CVE-2026-20097

References

advisory

Browse GCVE Records

74,299 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON