A preboot shell can weaken a safeguard meant to block unsafe software before an operating system starts. That is the concern behind CVE-2026-20293, a vulnerability in the shell on affected server platforms.
Cisco published advisory cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW on September 8, 2026. It described a path that could let an attacker run unauthorized software through the device’s preboot environment. The risk applies only when UEFI Secure Boot is supported, enabled, and paired with a vulnerable BIOS version.
Your review should start with those conditions. The advisory explains access requirements, ways to check whether your systems face exposure, plus software updates that address the flaw. Cisco also released fixes, so you can use the listed versions to plan remediation.
Keep this 2026 issue separate from a related 2020 advisory for Cisco UCS C-Series systems. That distinction helps you match the right fix to the right risk. The details below clarify what the bypass could mean for your security posture.
Key Takeaways
- CVE-2026-20293 affects a preboot shell.
- Exposure requires enabled Secure Boot plus a vulnerable BIOS version.
- Cisco published its advisory on September 8, 2026.
- Review access requirements, exposure checks, plus listed software fixes.
- Do not confuse this issue with the separate 2020 advisory.
What the Cisco UEFI Secure Boot Advisory Reported
The September 8, 2026, advisory focused on one firmware component, not every platform feature. It described a shell flaw that weakened secure boot validation when protection was enabled.
CVE-2026-20293 and the affected firmware component
Cisco identified the issue as CVE-2026-20293. With UEFI Secure Boot enabled, memory write commands remained available in the shell. That gap could affect a device running a vulnerable BIOS version. Cisco also assigned bug IDs CSCwt77804, CSCwt77950, CSCwt77952, CSCwt78022, CSCwu42927, and CSCwu42928.
What Cisco confirmed about exploitation and malicious use
A user or admin account with valid credentials could provide access. An unauthenticated attacker needed physical access to the affected system. Cisco PSIRT knew of proof-of-concept code, but reported no known malicious use at publication.
“Cisco PSIRT was aware of proof-of-concept exploit code but was not aware of malicious use.”
Stas Lyakhov of Eclypsium received credit for reporting the flaw. Tenable plugin 348181 rated the finding High for Cisco UCS Manager Software.
| Advisory detail | Reported information | Why it matters |
|---|---|---|
| Access | Valid role credentials or physical access | Exposure depends on who can reach the system |
| Exploit status | Proof-of-concept code known; no malicious use reported | Track risk without assuming active attacks |
| Detection | Tenable plugin 348181; High rating | Supports security checks for Cisco UCS servers |
How UEFI Secure Boot Protects Your Boot Process
Startup checks help keep untrusted code from taking control before your operating system loads. UEFI Secure Boot checks a digital signature before approved code can run.
How signature validation helps prevent unauthorized software
A trusted code creator signs executable code with a private key. A matching public key, stored on the system, lets firmware check that signature. This validation helps confirm the code came from a trusted source without changes.
With secure boot enabled, the system checks boot files during startup. For supported Cisco systems, Cisco development teams sign software images to help detect tampering.
“Boot code runs without modification.”
This protection relies on checks that work as intended. CVE-2026-20293 involved memory-write commands in the UEFI Shell, a concern for the preboot environment.
| Part | Role | Security value |
|---|---|---|
| Private key | Signs executable code | Identifies its trusted creator |
| Stored public key | Checks the signature | Helps detect altered code |
| Startup check | Reviews code before it runs | Blocks untrusted software |
How the UEFI Shell Secure Boot Bypass Works
The UEFI Shell provides a command line for debugging, scripts, plus boot settings. On affected servers, it also offered commands that could change protected memory. This created a path around normal startup checks when Secure Boot was enabled.
Memory write commands and UEFI memory variables
At boot time, an attacker could select the shell boot option, then change UEFI memory variables with available commands. These values can shape how firmware handles startup rules. The vulnerability left memory write commands available in the shell, even with protection active.
How changes could undermine validation
Changing Secure Boot-related values could alter the preboot environment. That may weaken signature checks, letting unauthorized software run before the operating system loads. A successful exploit did not mean every exposed device was compromised.
“Secure Boot enabled: memory-write commands should not remain available in the shell.”
Cisco addressed the flaw by removing those commands whenever Secure Boot was enabled. This change restored a key layer of boot validation.
What an Attacker Needs to Exploit the Vulnerability
Exposure depended on access, not just firmware status. Cisco listed two paths: valid credentials for a user- or admin-role account, or local access to the affected device. Secure Boot being enabled did not, by itself, mean someone could reach the system.
For the credentialed route, an attacker needed an authorized account. For the other route, an unauthenticated attacker needed physical access. The advisory did not describe an internet-only remote exploit that worked without credentials or local access.
The documented method used the UEFI shell boot option during startup. Available commands could change memory values in the preboot environment. That activity could allow an attacker to run unauthorized software, creating a security risk for affected appliances.
When you assess exposure, review these conditions:
- Who can use local consoles or reach the device in person?
- Which accounts have user or admin permissions?
- Does the system run affected software with UEFI Secure Boot enabled?
These checks help you judge whether the vulnerability could be exploited in your environment. They also separate a practical access concern from a general firmware finding.
Which Cisco UCS Servers Are Affected
The affected list spans several server families, plus a few edge platforms. A model alone does not confirm exposure; you also need to check its firmware state.
B-Series, C-Series, E-Series, S-Series, and X-Series systems
Cisco listed B-Series blade servers, C-Series rack servers, E-Series M3 and M6 systems, S-Series storage servers, plus X-Series platforms. The high-performance C-Series rack servers included the C845A M8, C880A M8, and C885A M8.
Other affected platforms, including ENCS and Unified Edge
The list also covered 5000 Series ENCS, Unified Edge, plus select systems. For the 2026 issue, exposure required Secure Boot to be enabled with a vulnerable BIOS version installed. Your review should confirm the platform, firmware release, plus boot setting. Cisco UCS servers were affected only when those conditions applied.
Keep the older finding separate. A February 19, 2020 advisory named Secure Network Server 3500 and 3600 appliances, but it addressed a different firmware flaw. That advisory does not identify those appliances as affected by the 2026 issue.
| Platform group | Examples listed | Exposure detail |
|---|---|---|
| Server families | B-Series, C-Series, E-Series, S-Series, X-Series | Check model, software version, Secure Boot status |
| Other platforms | 5000 Series ENCS, Unified Edge | Review affected firmware releases |
| Separate 2020 advisory | Secure Network Server 3500, 3600 appliances | Different firmware vulnerability |
Which UCS-Based Appliances May Be Exposed
Your appliance inventory may include more than standard server hardware. Cisco listed several product families, though exposure depended on platform setup plus console access. The issue affected only systems that met the advisory’s conditions.
Console access plus firmware support shaped exposure
UCS-based appliances were at risk only when the platform supported UEFI Secure Boot, secure boot enabled was active, plus KVM or virtual KVM-console access was available. Listed families included APIC, Cisco Telemetry Broker, HyperFlex, IEC6400 Edge Compute, IOS XRv 9000 M7, Nexus Dashboard, plus Secure Network Server systems.
Physical KVM access narrowed the attack path
Secure Email Gateways, Secure Email and Web Manager, plus Secure Web models required physical KVM access. That limited who could reach the preboot console, which reduced the attack path. Still, this access barrier did not replace a firmware update.
Other named security products included Secure Endpoint Private Cloud, Secure Firewall Management Center, Secure Malware Analytics, plus Secure Network Analytics. Check each model’s console setup before you judge its exposure.
| Appliance group | Examples | Access condition |
|---|---|---|
| Infrastructure | APIC, HyperFlex, Nexus Dashboard | KVM or virtual KVM console |
| Security | Secure Email, Secure Web, Secure Network Server | Physical KVM for named models |
| Other platforms | IEC6400 Edge Compute, IOS XRv 9000 M7 | Confirm support plus console access |
What a Successful Exploit Could Mean for Your Systems
A successful exploit could let an attacker alter the preboot environment, then overwrite memory values to bypass UEFI Secure Boot checks. This secure boot bypass could weaken validation before the operating system starts.
Cisco described a possible outcome: unauthorized software could run on the affected device. That means the vulnerability could undermine a key security step early in startup.
It does not mean every listed server or appliance was compromised. The advisory described possible impact on systems that met the exposure conditions; it did not confirm broad compromise.
“Potential impact is not proof of compromise.”
Because the check runs before the operating system loads, changes at this stage could affect later trust decisions. Your risk review should focus on systems with vulnerable firmware plus the required access path.
Cisco PSIRT reported no known malicious use. Treat that report separately from the vulnerability’s possible impact. Review servers plus appliances in your environment, then prioritize updates through your normal change process.
Severity Scores and Practical Risk Considerations
Tenable’s findings offer a starting point for prioritizing CVE-2026-20293. Plugin 348181 marked the vulnerability High severity. The figures support a Cisco security review, but they do not show whether a system was exposed. Your risk depends on Secure Boot status, console access, plus the device’s role. One rating can mean different things across servers or appliances.
How the reported CVSS and VPR scores inform your assessment
Use each score as context for a local review, not as a substitute for checking your systems.
- CVSS v3.0: base score 7.1; temporal rating 6.4.
- CVSS v2: base score 6.2; temporal rating 4.9.
- VPR: score 7, rated High, at the 98.05 percentile.
The advisory confirmed fixed software was available. Compare the installed version with the affected-release guidance, then prioritize systems that meet exposure conditions. A High rating merits attention, while access paths plus business role help set urgency. Keep your security plan focused on the update, especially for systems that support critical services.
Proof-of-Concept Availability and Known Exploitation
CVE-2026-20293 had proof-of-concept code available, Cisco PSIRT reported. Tenable plugin 348181 also marked “Exploit Available” as true. These findings show that a working demonstration existed; they do not prove active attacks against every affected system.
At publication, the advisory said PSIRT knew of no malicious use. That report did not erase the vulnerability or remove the need to check exposure. Your cisco security review should separate code availability from confirmed compromise, especially across appliances.
The documented route used the UEFI shell boot process, including selection of the shell boot option. However, access still required valid credentials or physical access. Code availability did not remove those limits.
Track changes to the advisory, confirm affected platform firmware, then move each system to a fixed software release. Review console access as part of your assessment. Treat this finding as a priority, but base incident response on evidence of compromise. Keep records of completed checks for later review.
How to Check Whether Your Device Is Vulnerable
A short inventory check can show whether a system met the exposure conditions. Record its model, BIOS release, plus whether secure boot enabled was active. Cisco tied the 2026 vulnerability to that setting plus a vulnerable BIOS version.
Confirm Secure Boot Status, Platform Model, BIOS Version
Check firmware settings to confirm UEFI Secure Boot status. Note the exact model plus installed version. A device running vulnerable BIOS may face risk when the required setting is active. Include servers plus appliances in your review.
Check Whether Your Installed Firmware Release Is Affected
Compare each release with the platform-specific Fixed Software entries in the advisory. Do not rely on a product family name alone. Use the listed fixed software releases to guide remediation.
For a Cisco FMC covered by the separate 2020 notice, run sudo dmidecode -t bios -q from the Linux shell in expert mode. For Secure Network Server systems, open Admin > Firmware Management. That page lists BIOS plus Cisco IMC, labeled BMC. Check current release details before deciding a system is clear or fixed.
| System | Where to check | What to confirm |
|---|---|---|
| Servers or appliances | Fixed Software section | Model, setting, affected BIOS release |
| Cisco FMC | Expert-mode Linux shell | BIOS details from the command |
| Secure Network Server | Admin > Firmware Management | BIOS plus IMC/BMC releases |
Fixed Cisco Software Releases for UCS Servers
Your fixed version depended on the server generation plus its management mode. Check the platform-specific advisory before you schedule an upgrade. Do not treat similar release numbers as interchangeable.
Release guidance by management mode
For Cisco UCS servers in UCS Manager mode, B-Series M5 used 4.3(6k) or 6.0(2e). B-Series M6 plus X-Series used 4.3(6h) or 6.0(2d). Intersight-managed B-Series M6 used 5.4(0.260050) or 6.0(2.260143); X-Series used 5.4(0.260042) or 6.0(2.260143). The M5 Intersight 5.4 fix was listed as TBD for November 2026.
Fixed firmware across server families
For C-Series M5 standalone or Intersight-managed systems, listed releases were 4.2(3r) plus 4.3(2.260020). UCS Manager mode used 4.2(3s), 4.3(6k), or 6.0(2e). M6, M7, plus M8 releases varied by mode: 4.2(3r), 4.3(6.260054), or 6.0(2.260143) for standalone or Intersight; 4.2(3s), 4.3(6h), or 6.0(2d) for UCS Manager.
C845A M8 plus C885A M8 fixes were TBD for October; C880A M8 used 4.0(2.260004). Other listed versions: E-Series M3 BIOS 4.04, E-Series M6 4.15.4b, S-Series 4.3(6.260054), Unified Edge 6.0(2.260143). ENCS fixed NFVIS versions were 4.12.9 plus 4.15.7; upgrades to Cisco IMC plus BIOS required NFVIS auto-upgrade. For C-Series M6–M8, HUU 6.0(2.260143) packaged IMC 6.0(2.260094). Review each security advisory before changing software.
Remediation for Cisco UCS-Based Appliances
For cisco ucs systems, the right fix depends on the appliance model, generation, plus update method. Cisco advised direct IMC plus BIOS upgrades for many C-Series-based appliances. Follow the product-specific guidance to protect system security.
Choose the package for your product
Use the listed version plus procedure for each platform:
- Telemetry Broker: 6.0(2.260143), with
CTB-FIRMWARE-6.0.2.260143-M6.iso. - IEC6400 Edge Compute: 4.3(6.260054), with
IEC6400-HUU-4.3.6-260054.img. - IOS XRv 9000 M7: 6.0(2.260143), with
xrv9k-ucs-c220m7-huu-container-6.0.2.260143.tar.gz. - Secure Email Gateways, Secure Email and Web Manager, plus Secure Web: 4.2(3r) for M5 or 4.3(6.260054) for M6; October 2026 firmware packages were listed.
- Secure Endpoint Private Cloud: 4.3(2.260020) for M5; 4.3(6.260054) for M6. Follow the TechNote.
- Secure Firewall Management Center: 4.3(2.260020) for M5; 6.0(2.260143) for M6 or M8. Apply the hotfix.
- Secure Malware Analytics: 4.3(2.260020) for M5; 4.3(6.260054) for M6. Use the Out-of-Band Firmware Update ISO procedure.
- Secure Network Analytics: use
patch-common-SNA-FIRMWARE-4.3.2.260020-M5-v2-01.swufor M5 orpatch-common-SNA-FIRMWARE-6.0.2260143-M6-v2-01.swufor M6. Secure Network Server fixes follow BIOS plus HUU guidance for 3600, 3700, or 3800 models.
Confirm the update took effect
After remediation, compare installed BIOS plus firmware with the fixed release in the advisory. Check model-specific details: packaged IMC software may display a different version from the HUU release. Keep the update record with your security review.
How to Plan a Safe Firmware Upgrade
A careful upgrade plan helps you avoid support issues during remediation. Before you schedule a change, confirm the target release fits your device and your maintenance window.
Check hardware and software compatibility before installation
Review the fixed-release table in the relevant advisory. Match the firmware to your platform, generation, plus management mode. Confirm the device has enough memory, too. Check that its current hardware configuration remains supported on the target version. For appliances, note any special update steps. This review can lower upgrade risk.
- Record the installed release plus boot settings.
- Check memory capacity before you begin.
- Confirm the planned release supports your device configuration.
Confirm support entitlements and consult Cisco guidance when needed
Download software only if your organization holds a valid license from Cisco, an authorized reseller, or a partner. Cisco recommends contacting TAC or your contracted maintenance provider when release support or steps remain unclear.
If you lack a service contract and cannot get the fixed update through your point of sale, contact TAC. Provide the product serial number plus the advisory URL. Confirm the security impact, then document the approved plan before installation.
Workarounds, Temporary Mitigations, and Remaining Exposure
Cisco security teams had no workaround that removed CVE-2026-20293. The advisory described any applicable mitigation as temporary, lasting only until you could install fixed software. Console limits or account reviews may narrow access, but they do not repair the vulnerability.
“Temporary controls can reduce exposure; they do not repair the flaw.”
Until an update was ready, teams could track each device’s Secure Boot status plus its BIOS or firmware release. This record helped show which systems still faced risk. Physical-console controls, account reviews, plus careful access checks could support short-term security planning in your environment.
- List devices with Secure Boot enabled.
- Flag systems with vulnerable firmware.
- Review console access plus account permissions.
Cisco strongly recommended installing the fixed release. That update addressed the flaw in the preboot shell. Treat temporary controls as a bridge, not a substitute for remediation. After the upgrade, verify the installed version against the release guidance.
Key Details in Cisco’s Advisory and Update History
The revision history shows how guidance changed over time. Version 1.0 appeared on September 8, 2026, with the initial report for CVE-2026-20293. For cisco security teams, later changes mattered because patch details shifted after publication.
On September 15, version 1.1 added remediation details for IOS XRv 9000 M7 appliances. On October 13, version 1.2 revised the fixed-release tables. Check the latest software entry for your platform before choosing a package.
The report credited Stas Lyakhov of Eclypsium as the source who identified the boot-shell bug. Keep the older C-Series finding separate. It concerned improper validation of firmware upgrade images, not the 2026 flaw.
| Date | Record | Key detail |
|---|---|---|
| September 8, 2026 | Version 1.0 | Initial CVE-2026-20293 report |
| September 15, 2026 | Version 1.1 | Updated IOS XRv 9000 M7 remediation |
| October 13, 2026 | Version 1.2 | Revised fixed-release tables |
| February 19, 2020; updated June 1, 2020 | Older C-Series notice | Separate security issue: firmware-image validation |
Conclusion
Your final review should focus on systems that met the stated conditions. CVE-2026-20293 affected eligible Cisco UCS servers plus appliances when secure boot was active with vulnerable BIOS software installed.
The advisory listed two access routes: a valid user- or admin-role account, or physical access to the device. Exploitation could change the preboot environment, weaken signature checks, then run unauthorized software.
The report noted proof-of-concept code, but no known malicious use. Tenable rated the vulnerability High, with a VPR score of 7. These facts support prompt security action, but do not prove a system was attacked.
Install the fixed release for each model. No workaround removed the flaw, so access limits could not replace remediation. Confirm the update, document the result, then check the advisory for changes.
