CVE-2026-20037 - Vulnerability Details

- Cisco UCS Manager File Write Vulnerability

Description

A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system.
 
This vulnerability exists because unnecessary privileges are given to the user. An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI. A successful exploit could allow the attacker to create or overwrite files in the file system or perform limited privileged actions on an affected device.   

Published: 2026-02-25

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from unnecessary file‑write permissions granted to users with read‑only privileges in the NX‑OS CLI of Cisco UCS Manager. An authenticated local attacker can log in as a read‑only user, connect through the CLI, and create or overwrite files on the device’s file system, potentially enabling further limited privileged actions. This weakness is a classic example of CWE‑250, where improper restriction of user privileges leads to unauthorized file modifications.

Affected Systems

The affected environment is Cisco Unified Computing System (Managed) – UCS Manager. No specific product or firmware version numbers are disclosed in the advisory, so all current UCS Manager releases may be at risk until Cisco publishes a patch.

Risk and Exploitability

The CVSS base score of 4.4 indicates a moderate impact, and the EPSS score of less than 1% shows that the probability of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with read‑only access and local CLI connectivity; it cannot be leveraged remotely. While the likelihood of an attack is low, the impact of unauthorized file changes could undermine system integrity and configuration management.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Unified Computing System (Managed)

unknown

Version	Status	Constraints
`4.0(4c)`	affected	—
`4.0(2b)`	affected	—
`4.1(2a)`	affected	—
`4.0(1a)`	affected	—
`4.0(2a)`	affected	—
`4.0(1b)`	affected	—
`4.1(1c)`	affected	—
`4.0(4a)`	affected	—
`4.0(4b)`	affected	—
`4.0(2e)`	affected	—
`4.1(1a)`	affected	—
`4.0(4d)`	affected	—
`4.0(4h)`	affected	—
`4.0(4g)`	affected	—
`4.0(1d)`	affected	—
`4.1(1e)`	affected	—
`4.0(4f)`	affected	—
`4.0(4e)`	affected	—
`4.0(4i)`	affected	—
`4.1(1d)`	affected	—
`4.0(2d)`	affected	—
`4.1(1b)`	affected	—
`4.0(1c)`	affected	—
`4.1(2b)`	affected	—
`4.0(4k)`	affected	—
`4.1(3a)`	affected	—
`4.1(3b)`	affected	—
`4.1(2c)`	affected	—
`4.0(4l)`	affected	—
`4.1(4a)`	affected	—
`4.1(3c)`	affected	—
`4.1(3d)`	affected	—
`4.2(1c)`	affected	—
`4.2(1d)`	affected	—
`4.0(4m)`	affected	—
`4.1(3e)`	affected	—
`4.2(1f)`	affected	—
`4.1(3f)`	affected	—
`4.2(1i)`	affected	—
`4.1(3h)`	affected	—
`4.2(1k)`	affected	—
`4.2(1l)`	affected	—
`4.0(4n)`	affected	—
`4.2(1m)`	affected	—
`4.1(3i)`	affected	—
`4.2(2a)`	affected	—
`4.2(1n)`	affected	—
`4.1(3j)`	affected	—
`4.2(2c)`	affected	—
`4.2(2d)`	affected	—
`4.2(3b)`	affected	—
`4.1(3k)`	affected	—
`4.0(4o)`	affected	—
`4.2(2e)`	affected	—
`4.2(3d)`	affected	—
`4.2(3e)`	affected	—
`4.2(3g)`	affected	—
`4.1(3l)`	affected	—
`4.3(2b)`	affected	—
`4.2(3h)`	affected	—
`4.2(3i)`	affected	—
`4.3(2c)`	affected	—
`4.1(3m)`	affected	—
`4.3(2e)`	affected	—
`4.3(3a)`	affected	—
`4.2(3j)`	affected	—
`4.3(3c)`	affected	—
`4.3(4a)`	affected	—
`4.2(3k)`	affected	—
`4.3(4b)`	affected	—
`4.3(4c)`	affected	—
`4.2(3l)`	affected	—
`4.3(4d)`	affected	—
`4.3(2f)`	affected	—
`4.2(3m)`	affected	—
`4.3(5a)`	affected	—
`4.3(4e)`	affected	—
`4.1(3n)`	affected	—
`4.3(4f)`	affected	—
`4.2(3n)`	affected	—
`4.3(5c)`	affected	—
`4.2(3o)`	affected	—
`4.3(5d)`	affected	—
`4.3(6a)`	affected	—
`4.3(6b)`	affected	—
`4.3(5e)`	affected	—
`4.3(6c)`	affected	—
`4.2(3p)`	affected	—
`4.3(6d)`	affected	—
`4.3(6e)`	affected	—

No data.

Vendor Product Confidence Versions

Cisco

Unified Computing System Manager

89%

Version	Status	Scheme	Platform
`4.0(4c)`	affected	generic	—
`4.0(2b)`	affected	generic	—
`4.1(2a)`	affected	generic	—
`4.0(1a)`	affected	generic	—
`4.0(2a)`	affected	generic	—
`4.0(1b)`	affected	generic	—
`4.1(1c)`	affected	generic	—
`4.0(4a)`	affected	generic	—
`4.0(4b)`	affected	generic	—
`4.0(2e)`	affected	generic	—
`4.1(1a)`	affected	generic	—
`4.0(4d)`	affected	generic	—
`4.0(4h)`	affected	generic	—
`4.0(4g)`	affected	generic	—
`4.0(1d)`	affected	generic	—
`4.1(1e)`	affected	generic	—
`4.0(4f)`	affected	generic	—
`4.0(4e)`	affected	generic	—
`4.0(4i)`	affected	generic	—
`4.1(1d)`	affected	generic	—
`4.0(2d)`	affected	generic	—
`4.1(1b)`	affected	generic	—
`4.0(1c)`	affected	generic	—
`4.1(2b)`	affected	generic	—
`4.0(4k)`	affected	generic	—
`4.1(3a)`	affected	generic	—
`4.1(3b)`	affected	generic	—
`4.1(2c)`	affected	generic	—
`4.0(4l)`	affected	generic	—
`4.1(4a)`	affected	generic	—
`4.1(3c)`	affected	generic	—
`4.1(3d)`	affected	generic	—
`4.1(2c)`	affected	generic	—
`4.0(4l)`	affected	generic	—
`4.1(4a)`	affected	generic	—
`4.2(1c)`	affected	generic	—
`4.2(1d)`	affected	generic	—
`4.0(4m)`	affected	generic	—
`4.1(3e)`	affected	generic	—
`4.2(1f)`	affected	generic	—
`4.1(3f)`	affected	generic	—
`4.2(1i)`	affected	generic	—
`4.1(3h)`	affected	generic	—
`4.2(1k)`	affected	generic	—
`4.2(1l)`	affected	generic	—
`4.0(4n)`	affected	generic	—
`4.2(1m)`	affected	generic	—
`4.1(3i)`	affected	generic	—
`4.2(2a)`	affected	generic	—
`4.2(1n)`	affected	generic	—
`4.1(3j)`	affected	generic	—
`4.2(2c)`	affected	generic	—
`4.2(2d)`	affected	generic	—
`4.2(3b)`	affected	generic	—
`4.1(3k)`	affected	generic	—
`4.0(4o)`	affected	generic	—
`4.2(2e)`	affected	generic	—
`4.2(3d)`	affected	generic	—
`4.2(3e)`	affected	generic	—
`4.2(3g)`	affected	generic	—
`4.1(3l)`	affected	generic	—
`4.3(2b)`	affected	generic	—
`4.2(3h)`	affected	generic	—
`4.2(3i)`	affected	generic	—
`4.3(2c)`	affected	generic	—
`4.1(3m)`	affected	generic	—
`4.3(2e)`	affected	generic	—
`4.3(3a)`	affected	generic	—
`4.2(3j)`	affected	generic	—
`4.3(3c)`	affected	generic	—
`4.3(4a)`	affected	generic	—
`4.2(3k)`	affected	generic	—
`4.3(4b)`	affected	generic	—
`4.3(4c)`	affected	generic	—
`4.2(3l)`	affected	generic	—
`4.3(4d)`	affected	generic	—
`4.3(2f)`	affected	generic	—
`4.2(3m)`	affected	generic	—
`4.3(5a)`	affected	generic	—
`4.3(4e)`	affected	generic	—
`4.1(3n)`	affected	generic	—
`4.3(4f)`	affected	generic	—
`4.2(3n)`	affected	generic	—
`4.3(5c)`	affected	generic	—
`4.2(3o)`	affected	generic	—
`4.3(5d)`	affected	generic	—
`4.3(6a)`	affected	generic	—
`4.3(6b)`	affected	generic	—
`4.3(5e)`	affected	generic	—
`4.3(6c)`	affected	generic	—
`4.2(3p)`	affected	generic	—
`4.3(6d)`	affected	generic	—
`4.3(6e)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Cisco UCS Manager firmware that addresses the file‑write privilege issue.
Restrict read‑only user roles to eliminate unnecessary file‑write permissions, following Cisco's recommended role‑based access controls.
Enable comprehensive logging and audit monitoring for CLI sessions to detect unauthorized file creation or modification.

Generated by OpenCVE AI on April 17, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00016.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsm-afwae-mOgUfyLn

History

Thu, 26 Feb 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Feb 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco unified Computing System Manager
Vendors & Products		Cisco Cisco unified Computing System Manager

Wed, 25 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system.   This vulnerability exists because unnecessary privileges are given to the user. An attacker could exploit this vulnerability by authenticating to a device as a read-only user and connecting to the NX-OS CLI. A successful exploit could allow the attacker to create or overwrite files in the file system or perform limited privileged actions on an affected device.
Title		Cisco UCS Manager File Write Vulnerability
Weaknesses		CWE-250
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsm-afwae-mOgUfyLn
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}`

Subscriptions

Cisco Unified Computing System Manager

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-02-25T16:24:09.650Z

Updated: 2026-02-25T19:05:48.855Z

Reserved: 2025-10-08T11:59:15.353Z

Link: CVE-2026-20037

Vulnrichment

Updated: 2026-02-25T18:17:48.760Z

NVD

Status : Deferred

Published: 2026-02-25T17:25:25.190

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-20037

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T15:15:21Z

Weaknesses

CWE-250

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object