Cisco has issued security updates to fix multiple serious vulnerabilities, including a flaw in the Integrated Management Controller (IMC) that could let attackers bypass security and gain administrator privileges.

Cisco IMC, also called CIMC, is a hardware component on Cisco server motherboards that allows remote management (even when the operating system is off or has crashed) for UCS C-Series and E-Series servers through various interfaces like XML API, web interface (WebUI), and command-line (CLI).

The vulnerability, identified as CVE-2026-20093, exists in the password change feature of Cisco IMC and can be exploited remotely by attackers without authentication to bypass security checks and gain administrator-level access to vulnerable systems.

“This vulnerability is caused by improper handling of password change requests. An attacker could exploit this vulnerability by sending a specially crafted HTTP request to an affected device,” Cisco stated on Wednesday.

“A successful exploit could allow the attacker to bypass authentication, change passwords for any user on the system, including administrators, and gain access as that user.”

While Cisco’s security team (PSIRT) hasn’t seen any evidence of this vulnerability being used in attacks or any publicly available exploit code, they “strongly recommends that customers update to the patched software” because there are no temporary workarounds to address this flaw.

This week, Cisco also released patches for a critical Smart Software Manager On-Prem (SSM On-Prem) vulnerability (CVE-2026-20160) that could allow attackers without authorization to execute code remotely on affected SSM On-Prem systems.

The CVE-2026-20160 vulnerability can be exploited by sending a malformed request to the exposed service’s API, allowing attackers to run commands on the underlying operating system with root privileges.

Earlier this month, Cisco patched a high-severity remote code execution (RCE) vulnerability (CVE-2026-20131) in the Secure Firewall Management Center (FMC), which the Interlock ransomware group exploited in zero-day attacks. CISA has also added CVE-2026-20131 to its list of actively exploited vulnerabilities, ordering federal agencies to secure their systems within three days.

BleepingComputer recently reported that Cisco’s internal development environment was compromised using credentials obtained during the recent Trivy supply chain attack.