Intel

CVE-2026-20293

Unified Computing System (UCS): Exposed Dangerous Method or Function (CVE-2026-20293)

highEPSS 0.2%

Affected

  • Cisco/Unified Computing System (UCS) = UEFI Shell implementation..UEFI Shell implementation
  • Insyde/UEFI Firmware < *..05.2B.17
  • Insyde/UEFI Firmware < *..05.3A.17
  • Insyde/UEFI Firmware < *..05.48.17
  • Insyde/UEFI Firmware < *..05.56.17
  • Insyde/UEFI Firmware < *..05.63.17
  • Insyde/UEFI Firmware < *..05.72.17

Fixed in

  • Insyde/UEFI Firmware 05.2B.17
  • Insyde/UEFI Firmware 05.3A.17
  • Insyde/UEFI Firmware 05.48.17
  • Insyde/UEFI Firmware 05.56.17
  • Insyde/UEFI Firmware 05.63.17
  • Insyde/UEFI Firmware 05.72.17

Description

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin&nbsp;or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software. This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.

Source: BSI WID PortalBSI CSAFNVD (NIST)cvelistv5cisco_csaf

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

CiscoUnified Computing System (UCS)
UEFI Shell implementation
InsydeUEFI Firmware
< 05.2B.17fixed in 05.2B.17< 05.3A.17fixed in 05.3A.17< 05.48.17fixed in 05.48.17< 05.56.17fixed in 05.56.17< 05.63.17fixed in 05.63.17< 05.72.17fixed in 05.72.17

Metrics

XIEM Effective CVSS
7.1
Source: nvd-v3
EPSS percentile
4.4 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
65.30
Exploit maturity
no public PoC known
CVSS v3
7.1
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-08 16:04 UTC
CWE
CWE-749

Weakness classes (CWE)

  • CWE-749Base

    Exposed Dangerous Method or Function

    The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-11 14:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-20293","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-09-08 17:17 UTC· psirt@cisco.com
    • Description: A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin&nbsp;or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized software. This vulnerability is due to the availability of memory write commands in the UEFI Shell while UEFI Secure Boot is enabled on a device. An attacker could exploit this vulnerability by selecting the UEFI Shell boot option at boot time and using available shell commands to modify UEFI memory variables. A successful exploit could allow the attacker to manipulate the preboot environment, overwrite UEFI Secure Boot-related memory values, and execute unauthorized software on the affected device.
    • CVSS V3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    • CWE: CWE-749
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/20xxx/CVE-2026-20293.json">CVE-2026-20293</a>

Linked advisories