CVE-2026-20037: medium-severity vulnerability in Cisco Unified Computing System (Managed)
Cisco UCS Manager File Write Vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.1%
A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system.
This vulnerability exists because unnecessary privileges are given to the user. An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI. A successful exploit could allow the attacker to create or overwrite files in the file system or perform limited privileged actions on an affected device.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
Cisco · Cisco Unified Computing System (Managed)Related CVEs — Cisco Unified Computing System (Managed)
In the same product, most dangerous first.
CVE-2020-3119HIGHCisco NX-OS Software Cisco Discovery Protocol Remote Code Execution VulnerabilityEPSS 4.8%CVE-2026-76455CRITICALCisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesEPSS 3.6%CVE-2025-20292MEDIUMCisco NXOS Software Command Injection VulnerabilityEPSS 3.2%CVE-2019-1962HIGHCisco NX-OS Software Cisco Fabric Services over IP Denial of Service VulnerabilityEPSS 2.0%CVE-2020-3172HIGHCisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and Denial of Service VulnerabilityEPSS 1.9%CVE-2019-1963HIGHCisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityEPSS 1.6%