Multiple high-severity vulnerabilities (CVSS 8.8) in Cisco Integrated Management Controller (IMC) allow an authenticated, remote attacker to perform cross-site scripting attacks or execute arbitrary code with root privileges. The flaws affect numerous Cisco IMC versions across Enterprise NFV, UCS C-Series (M5-M8), E-Series, S-Series, and specific Secure Endpoint, Firewall Management Center, and Secure Network Server appliances, with detailed version ranges listed in the advisory. Cisco has provided mitigations; administrators must consult the specific advisory (WID-SEC-2026-2673) for the exact fixed versions applicable to their affected products.
[WID-SEC-2026-2673] Cisco Integrated Management Controller: Mehrere Schwachstellen CVSS Base Score 8.8 (hoch) CVSS Temporal Score 7.9 (hoch) Remoteangriff ja Datum 05.08.2026 Stand 06.08.2026 Mitigation ja Betroffene Systeme Betriebssystem BIOS/Firmware CISCO Appliance Produktbeschreibung Der Cisco Integrated Management Controller ist eine Serververwaltung für mehrere Cisco-Produkte. Cisco Secure Endpoint bietet Virenschutz und erweiterte Endpunkt-Erkennung und -Reaktion. Das Cisco Secure Firewall Management Center ist eine zentralisierte Plattform, die eine Verwaltung und Überwachung von Cisco Firewall-Geräten ermöglicht. Cisco Secure Network Server bietet Dienste zur Identitäts- und Zugriffsverwaltung. Produkte 05.08.2026 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS <4.12.8 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software ENCS <4.15.6 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.12.8 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.15.6 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <4.18.5 Cisco Integrated Management Controller Enterprise NFV Infrastructure Software uCPE <26.1.2 Cisco Integrated Management Controller UCS C-Series M5 Rack Server <4.2(3r) Cisco Integrated Management Controller UCS C-Series M5 Rack Server <4.3(2.260020) Cisco Integrated Management Controller UCS C-Series M6 Rack Server <4.2(3r) Cisco Integrated Management Controller UCS C-Series M6 Rack Server <4.3(6.260054) Cisco Integrated Management Controller UCS C-Series M6 Rack Server <6.0(2.260143) Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server <4.3(6.260033) Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server <4.3(6.260054) Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server <6.0(2.260044) Cisco Integrated Management Controller UCS C-Series M7 and M8 Rack Server <6.0(2.260143) Cisco Integrated Management Controller UCS E-Series M3 <3.2.18.1 Cisco Integrated Management Controller UCS E-Series M6 <4.15.4 Cisco Integrated Management Controller UCS S-Series Storage Server <4.3(6.260054) Cisco Secure Endpoint Private Cloud Appliances <4.3(2.260020) (M5) Cisco Secure Endpoint Private Cloud Appliances <4.3(6.260054) (M6) Cisco Secure Firewall Management Center Appliances <4.3(2.260020) (M5) Cisco Secure Firewall Management Center Appliances <6.0(2.260143) (M6, M8) Cisco Secure Network Server Appliances <4.3(2.260020) (M5) Cisco Secure Network Server Appliances <6.0(2.260143) (M6, M8) Angriff Angriff Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen im Cisco Integrated Management Controller ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen oder beliebigen Code mit Root-Rechten auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben