Cisco Unified Computing System vulnerabilities

119 CVEs affecting Cisco Unified Computing System, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20288, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2024-20356, published 2024-04-24. High severity, CVSS 8.7. EPSS: 29.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with Administrator-level privileges to perform…
CVE-2020-10136, published 2020-06-02. Medium severity, CVSS 5.3. EPSS: 28.5% chance of exploitation in the next 30 days. IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected…
CVE-2015-6435, published 2016-01-22. Critical severity, CVSS 9.8. EPSS: 8.7% chance of exploitation in the next 30 days. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows…
CVE-2018-0431, published 2018-10-05. High severity, CVSS 8.8. EPSS: 4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands…
CVE-2018-0430, published 2018-10-05. High severity, CVSS 8.8. EPSS: 4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands…
CVE-2015-0718, published 2016-03-03. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack…
CVE-2019-1885, published 2019-08-21. High severity, CVSS 7.2. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on…
CVE-2019-1865, published 2019-08-21. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are…
CVE-2012-4078, published 2013-09-24. High severity, CVSS 8.5. EPSS: 3.5% chance of exploitation in the next 30 days. The Baseboard Management Controller (BMC) in Cisco Unified Computing System (UCS) does not properly handle SSH escape sequences, which allows remote authenticated users to bypass an unspecified…

Latest

CVE-2026-20288, published 2026-08-05. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating…
CVE-2026-20200, published 2026-08-05. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system…
CVE-2026-20097, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitrary code as the root user. This…
CVE-2026-20096, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system…
CVE-2026-20095, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to perform command injection attacks on an affected system…
CVE-2026-20094, published 2026-04-01. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges to perform command injection attacks on an affected system…
CVE-2026-20090, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20089, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20088, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…
CVE-2026-20087, published 2026-04-01. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the…