Command Injection in Cisco FXOS/UCS Manager Web UI Elevates to Root
CVE-2026-20099 Published on February 25, 2026
Cisco UCS Manager and FXOS Software Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root.
This vulnerability is due to insufficient input validation of command arguments supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of the affected device with root-level privileges.
Vulnerability Analysis
CVE-2026-20099 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-20099 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-20099
stack.watch emails you whenever new vulnerabilities are published in Cisco Adaptive Security Appliance or Cisco Unified Computing System. Just hit a watch button to start following.
Affected Versions
Cisco Firepower Extensible Operating System (FXOS):- Version 2.3.1.99 is affected.
- Version 2.3.1.56 is affected.
- Version 2.3.1.110 is affected.
- Version 2.3.1.58 is affected.
- Version 2.6.1.174 is affected.
- Version 2.6.1.157 is affected.
- Version 2.3.1.91 is affected.
- Version 2.3.1.73 is affected.
- Version 2.3.1.66 is affected.
- Version 2.6.1.166 is affected.
- Version 2.3.1.111 is affected.
- Version 2.3.1.166 is affected.
- Version 2.3.1.144 is affected.
- Version 2.6.1.131 is affected.
- Version 2.3.1.130 is affected.
- Version 2.3.1.88 is affected.
- Version 2.6.1.169 is affected.
- Version 2.3.1.75 is affected.
- Version 2.3.1.93 is affected.
- Version 2.3.1.145 is affected.
- Version 2.3.1.155 is affected.
- Version 2.6.1.187 is affected.
- Version 2.3.1.173 is affected.
- Version 2.3.1.179 is affected.
- Version 2.6.1.192 is affected.
- Version 2.3.1.180 is affected.
- Version 2.6.1.204 is affected.
- Version 2.6.1.214 is affected.
- Version 2.3.1.190 is affected.
- Version 2.6.1.224 is affected.
- Version 2.6.1.229 is affected.
- Version 2.3.1.215 is affected.
- Version 2.10.1.159 is affected.
- Version 2.3.1.216 is affected.
- Version 2.6.1.230 is affected.
- Version 2.10.1.166 is affected.
- Version 2.6.1.238 is affected.
- Version 2.6.1.239 is affected.
- Version 2.11.1.154 is affected.
- Version 2.10.1.179 is affected.
- Version 2.3.1.219 is affected.
- Version 2.6.1.254 is affected.
- Version 2.12.0.31 is affected.
- Version 2.12.0.432 is affected.
- Version 2.10.1.207 is affected.
- Version 2.3.1.230 is affected.
- Version 2.6.1.259 is affected.
- Version 2.11.1.182 is affected.
- Version 2.12.0.450 is affected.
- Version 2.10.1.234 is affected.
- Version 2.13.0.198 is affected.
- Version 2.12.0.467 is affected.
- Version 2.13.0.212 is affected.
- Version 2.6.1.264 is affected.
- Version 2.10.1.245 is affected.
- Version 2.11.1.200 is affected.
- Version 2.12.0.498 is affected.
- Version 2.10.1.271 is affected.
- Version 2.12.1.29 is affected.
- Version 2.13.0.243 is affected.
- Version 2.11.1.205 is affected.
- Version 2.6.1.265 is affected.
- Version 2.12.1.48 is affected.
- Version 2.14.1.131 is affected.
- Version 2.13.0.276 is affected.
- Version 2.11.1.228 is affected.
- Version 2.12.1.72 is affected.
- Version 2.10.1.312 is affected.
- Version 2.6.1.272 is affected.
- Version 2.14.1.143 is affected.
- Version 2.14.1.163 is affected.
- Version 2.14.1.167 is affected.
- Version 2.12.1.84 is affected.
- Version 2.16.0.128 is affected.
- Version 2.10.1.328 is affected.
- Version 2.10.1.341 is affected.
- Version 2.11.1.236 is affected.
- Version 2.12.1.95 is affected.
- Version 2.13.0.357 is affected.
- Version 2.16.0.136 is affected.
- Version 2.14.1.186 is affected.
- Version 2.17.0.518 is affected.
- Version 2.14.1.187 is affected.
- Version 9.12.2 is affected.
- Version 9.12.1 is affected.
- Version 9.12.3 is affected.
- Version 9.12.4 is affected.
- Version 9.12.3.2 is affected.
- Version 9.12.3.12 is affected.
- Version 9.12.2.5 is affected.
- Version 9.12.1.2 is affected.
- Version 9.12.2.1 is affected.
- Version 9.12.3.7 is affected.
- Version 9.12.2.9 is affected.
- Version 9.12.3.9 is affected.
- Version 9.12.1.3 is affected.
- Version 9.12.4.2 is affected.
- Version 9.12.4.4 is affected.
- Version 9.12.4.7 is affected.
- Version 9.12.4.8 is affected.
- Version 9.12.4.10 is affected.
- Version 9.12.4.13 is affected.
- Version 9.12.4.18 is affected.
- Version 9.12.4.24 is affected.
- Version 9.16.1 is affected.
- Version 9.12.4.26 is affected.
- Version 9.16.1.28 is affected.
- Version 9.12.4.29 is affected.
- Version 9.16.2 is affected.
- Version 9.12.4.30 is affected.
- Version 9.16.2.3 is affected.
- Version 9.12.4.35 is affected.
- Version 9.16.2.7 is affected.
- Version 9.12.4.37 is affected.
- Version 9.17.1 is affected.
- Version 9.16.2.11 is affected.
- Version 9.16.2.13 is affected.
- Version 9.12.4.39 is affected.
- Version 9.12.4.38 is affected.
- Version 9.16.2.14 is affected.
- Version 9.17.1.7 is affected.
- Version 9.12.4.40 is affected.
- Version 9.16.3.3 is affected.
- Version 9.16.3 is affected.
- Version 9.17.1.9 is affected.
- Version 9.16.3.14 is affected.
- Version 9.12.4.41 is affected.
- Version 9.17.1.10 is affected.
- Version 9.18.1 is affected.
- Version 9.12.4.47 is affected.
- Version 9.16.3.15 is affected.
- Version 9.18.1.3 is affected.
- Version 9.17.1.11 is affected.
- Version 9.12.4.48 is affected.
- Version 9.18.2 is affected.
- Version 9.16.3.19 is affected.
- Version 9.17.1.13 is affected.
- Version 9.12.4.50 is affected.
- Version 9.17.1.15 is affected.
- Version 9.12.4.52 is affected.
- Version 9.16.3.23 is affected.
- Version 9.18.2.5 is affected.
- Version 9.16.4 is affected.
- Version 9.12.4.54 is affected.
- Version 9.17.1.20 is affected.
- Version 9.18.2.7 is affected.
- Version 9.19.1 is affected.
- Version 9.16.4.9 is affected.
- Version 9.12.4.55 is affected.
- Version 9.18.2.8 is affected.
- Version 9.16.4.14 is affected.
- Version 9.18.3 is affected.
- Version 9.19.1.5 is affected.
- Version 9.12.4.56 is affected.
- Version 9.17.1.30 is affected.
- Version 9.19.1.9 is affected.
- Version 9.18.3.39 is affected.
- Version 9.16.4.19 is affected.
- Version 9.12.4.58 is affected.
- Version 9.19.1.12 is affected.
- Version 9.18.3.46 is affected.
- Version 9.16.4.27 is affected.
- Version 9.19.1.18 is affected.
- Version 9.18.3.53 is affected.
- Version 9.18.3.55 is affected.
- Version 9.16.4.38 is affected.
- Version 9.17.1.33 is affected.
- Version 9.12.4.62 is affected.
- Version 9.16.4.39 is affected.
- Version 9.18.3.56 is affected.
- Version 9.16.4.42 is affected.
- Version 9.19.1.22 is affected.
- Version 9.18.4 is affected.
- Version 9.18.4.5 is affected.
- Version 9.19.1.24 is affected.
- Version 9.16.4.48 is affected.
- Version 9.18.4.8 is affected.
- Version 9.20.2 is affected.
- Version 9.19.1.27 is affected.
- Version 9.12.4.65 is affected.
- Version 9.16.4.55 is affected.
- Version 9.18.4.22 is affected.
- Version 9.20.2.10 is affected.
- Version 9.16.4.57 is affected.
- Version 9.19.1.28 is affected.
- Version 9.17.1.39 is affected.
- Version 9.12.4.67 is affected.
- Version 9.18.4.24 is affected.
- Version 9.20.2.21 is affected.
- Version 9.16.4.61 is affected.
- Version 9.19.1.31 is affected.
- Version 9.18.4.29 is affected.
- Version 9.20.2.22 is affected.
- Version 9.16.4.62 is affected.
- Version 9.18.4.34 is affected.
- Version 9.20.3 is affected.
- Version 9.16.4.67 is affected.
- Version 9.18.4.40 is affected.
- Version 9.16.4.71 is affected.
- Version 9.20.3.4 is affected.
- Version 9.18.4.47 is affected.
- Version 9.20.3.7 is affected.
- Version 9.17.1.45 is affected.
- Version 9.19.1.37 is affected.
- Version 9.16.4.76 is affected.
- Version 9.18.4.50 is affected.
- Version 9.20.3.10 is affected.
- Version 9.18.4.52 is affected.
- Version 9.20.3.13 is affected.
- Version 9.18.4.53 is affected.
- Version 9.16.4.82 is affected.
- Version 9.20.3.16 is affected.
- Version 9.19.1.42 is affected.
- Version 9.18.4.57 is affected.
- Version 9.16.4.84 is affected.
- Version 9.20.3.20 is affected.
- Version 9.20.4 is affected.
- Version 9.20.4.7 is affected.
- Version 4.0(4h) is affected.
- Version 4.1(1a) is affected.
- Version 4.0(1c) is affected.
- Version 4.0(4a) is affected.
- Version 4.0(1a) is affected.
- Version 4.0(1d) is affected.
- Version 4.1(1c) is affected.
- Version 4.0(2a) is affected.
- Version 4.0(4g) is affected.
- Version 4.0(2e) is affected.
- Version 4.0(4c) is affected.
- Version 4.0(4f) is affected.
- Version 4.0(1b) is affected.
- Version 4.0(2b) is affected.
- Version 4.0(2d) is affected.
- Version 4.1(1b) is affected.
- Version 4.0(4d) is affected.
- Version 4.0(4e) is affected.
- Version 4.0(4b) is affected.
- Version 4.1(2a) is affected.
- Version 4.1(1d) is affected.
- Version 4.0(4i) is affected.
- Version 4.1(1e) is affected.
- Version 4.1(2b) is affected.
- Version 4.0(4k) is affected.
- Version 4.1(3a) is affected.
- Version 4.1(3b) is affected.
- Version 4.1(2c) is affected.
- Version 4.0(4l) is affected.
- Version 4.1(4a) is affected.
- Version 4.1(3c) is affected.
- Version 4.1(3d) is affected.
- Version 4.2(1c) is affected.
- Version 4.2(1d) is affected.
- Version 4.0(4m) is affected.
- Version 4.1(3e) is affected.
- Version 4.2(1f) is affected.
- Version 4.1(3f) is affected.
- Version 4.2(1i) is affected.
- Version 4.1(3h) is affected.
- Version 4.2(1k) is affected.
- Version 4.2(1l) is affected.
- Version 4.0(4n) is affected.
- Version 4.2(1m) is affected.
- Version 4.1(3i) is affected.
- Version 4.2(2a) is affected.
- Version 4.2(1n) is affected.
- Version 4.1(3j) is affected.
- Version 4.2(2c) is affected.
- Version 4.2(2d) is affected.
- Version 4.2(3b) is affected.
- Version 4.1(3k) is affected.
- Version 4.0(4o) is affected.
- Version 4.2(2e) is affected.
- Version 4.2(3d) is affected.
- Version 4.2(3e) is affected.
- Version 4.2(3g) is affected.
- Version 4.1(3l) is affected.
- Version 4.3(2b) is affected.
- Version 4.2(3h) is affected.
- Version 4.2(3i) is affected.
- Version 4.3(2c) is affected.
- Version 4.1(3m) is affected.
- Version 4.3(2e) is affected.
- Version 4.3(3a) is affected.
- Version 4.2(3j) is affected.
- Version 4.3(3c) is affected.
- Version 4.3(4a) is affected.
- Version 4.2(3k) is affected.
- Version 4.3(4b) is affected.
- Version 4.3(4c) is affected.
- Version 4.2(3l) is affected.
- Version 4.3(4d) is affected.
- Version 4.3(2f) is affected.
- Version 4.2(3m) is affected.
- Version 4.3(5a) is affected.
- Version 4.3(4e) is affected.
- Version 4.1(3n) is affected.
- Version 4.3(4f) is affected.
- Version 4.2(3n) is affected.
- Version 4.3(5c) is affected.
- Version 4.2(3o) is affected.
- Version 4.3(5d) is affected.
- Version 4.3(6a) is affected.
- Version 4.3(6b) is affected.
- Version 4.3(5e) is affected.
- Version 4.2(3p) is affected.
Exploit Probability
EPSS
0.06%
Percentile
19.84%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.