Multiple Cisco Vulnerabilities Expose Systems to Command Injection and Configuration Alteration

• •Cisco disclosed critical vulnerabilities in multiple products affecting command execution and configuration.
• •CVE-2026-20288 and CVE-2026-20200 allow privilege escalation and command injection.
• •Software updates are available, but no workarounds exist for these vulnerabilities.

Cisco has disclosed multiple vulnerabilities affecting its products, including the Integrated Management Controller, BroadWorks CommPilot Application Software, and ThousandEyes Virtual Appliance. The vulnerabilities allow authenticated attackers to execute arbitrary commands or alter configurations due to improper validation and missing authorization checks. CVE-2026-20288 and CVE-2026-20200, both published on 2026-08-05, are among the critical vulnerabilities that could lead to privilege escalation. Cisco has released software updates to address these issues, but no workarounds are available. The vulnerabilities affect a wide range of Cisco products, including various UCS servers and appliances. Security professionals are urged to apply the updates promptly to mitigate risks.