Cisco UCS UEFI Shell Secure Boot Bypass (CVE-2026-20293)
At a glance
| Severity | HIGH |
|---|---|
| CVSS | CVE-2026-20293: 7.1 |
| EPSS (30-day exploit probability) | CVE-2026-20293: 0.2% |
| In CISA KEV (exploited) | No |
| Vendor | Cisco |
| CVE IDs | CVE-2026-20293 |
Cisco has published an advisory for a Cisco UCS Secure Boot bypass tracked as CVE-2026-20293, rated High with a CVSS base score of 7.1. According to the Cisco Security Advisory, the flaw sits in the UEFI Shell of UCS servers and UCS-based appliances. Cisco has released software updates and says there are no workarounds. Our sources do not mention active exploitation, and no CISA KEV listing was found in our data.
What happened
The UEFI Shell on affected devices exposes memory write commands even when UEFI Secure Boot is enabled. An attacker who selects the UEFI Shell boot option at boot time can use those commands to change UEFI memory variables. That lets them manipulate the preboot environment, overwrite Secure Boot-related values and run unauthorized software.
Secure Boot is meant to ensure only trusted code runs before the operating system. Defeating it undermines a protection that sits below the OS, where most endpoint tools cannot see.
The advisory was first published on 2026 September 8 and last updated on 2026 October 13. The weakness is classed as CWE-749 (exposed dangerous method or function).
Am I affected?
Cisco says a product is vulnerable if UEFI Secure Boot is enabled and it runs a vulnerable BIOS version. The exact fixed BIOS releases are not listed in the data we reviewed, so check the advisory for your model. Affected products named by Cisco:
- 5000 Series Enterprise Network Compute Systems (ENCS)
- UCS B-Series Blade Servers
- UCS C-Series Rack Servers, including the C845A, C885A and C880A models
- UCS E-Series Servers (M3 and M6)
- UCS S-Series Storage Servers
- UCS X-Series Modular System
- Unified Edge
Appliances built on a preconfigured UCS C-Series server are also affected if they support UEFI Secure Boot and expose KVM or virtual KVM console access. At publication, Cisco listed products including:
- Application Policy Infrastructure Controller (APIC) servers
- Cisco Telemetry Broker appliances
- HyperFlex and HyperFlex Edge nodes
- IEC6400 Edge Compute Appliances
- Nexus Dashboard appliances
- Secure Email Gateway and Secure Email and Web Manager
- Secure Firewall Management Center (FMC) appliances
- Secure Endpoint Private Cloud and Secure Malware Analytics appliances
The advisory list continues beyond this; the full list is in Cisco’s advisory.
Technical details
- CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, a local attack vector with low complexity and low privileges, and high impact on confidentiality and integrity.
- Who can exploit it: an authenticated user with the user or admin role, or an unauthenticated attacker with physical access to the device.
- EPSS: 0.00158, roughly a 0.16% estimated chance of exploitation in the next 30 days.
- Exploitation status: not disclosed as exploited in our sources.
- Workarounds: none available, according to Cisco.
Note the wording: the description allows an authenticated attacker, yet the practical route is the boot-time UEFI Shell, which needs console access such as KVM, virtual KVM or physical presence.
Why this matters
This section is our analysis, not new facts from Cisco. The low EPSS score and the need for console or physical access make mass exploitation over the network unlikely. The realistic risk is in shared or remote-managed environments: colocation racks, branch edge compute, and data centers where many admins hold virtual KVM access. A low-privileged account with KVM access could be turned into persistence below the operating system, which survives reinstalls and is hard to detect.
Because there is no workaround, prioritise by exposure. Servers and appliances in locations with weaker physical controls, or with broad KVM access, should be updated first. Where the device is a security appliance such as a management center or email gateway, treat the update as higher priority, since compromise there gives an attacker a strong foothold.
What to do
- Inventory Cisco UCS servers and UCS-based appliances, including appliances that are built on UCS C-Series hardware and are easy to overlook.
- Check each against the NVD entry and Cisco’s advisory to confirm whether Secure Boot is enabled and which BIOS version runs.
- Apply the BIOS or software updates Cisco has released for your platform. No workaround exists.
- Until updated, restrict who holds user or admin roles on the device management interface, and limit KVM and virtual KVM console access to those who need it.
- Review physical access to affected hardware in shared facilities.
Detection and hunting ideas
Cisco has not published indicators of compromise for this flaw. Reasonable checks that follow from the facts: review management controller and KVM session logs for unexpected sessions, look for unplanned reboots or boot-option changes, and compare firmware and Secure Boot state against your known-good baseline.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
