Cisco Fixes UEFI Secure Boot Bypass in UCS Servers and Appliances
Cisco patches a high-severity flaw allowing attackers to bypass Secure Boot validation on UCS hardware via the UEFI Shell.
Key points
- Cisco released updates for CVE-2026-20293, a UEFI Secure Boot bypass vulnerability.
- Attackers with physical access or valid credentials can execute unauthorized software.
- No workarounds exist; users must apply the provided software updates.
Cisco has released software updates to address a high-severity vulnerability in its Unified Computing System (UCS) servers and appliances. The flaw, tracked as CVE-2026-20293, allows attackers to bypass UEFI Secure Boot validation checks. This enables the execution of unauthorized software on affected devices.
At a glance
- Publisher
- Cisco PSIRT
- CVEs
- CVE-2026-49785
The vulnerability stems from memory write commands remaining available in the UEFI Shell even when Secure Boot is enabled. An attacker can exploit this by selecting the UEFI Shell boot option at startup. They can then use shell commands to modify UEFI memory variables and overwrite Secure Boot-related values.
Technical Context and Impact
According to the Cisco security advisory, the issue affects the UEFI Shell implementation on Cisco UCS Servers and UCS-based appliances. The Common Vulnerability Scoring System (CVSS) base score is 7.1, which Cisco rates as high. The flaw allows an authenticated attacker with user or admin credentials to bypass security checks.
An unauthenticated attacker with physical access to the device can also exploit the vulnerability. Successful exploitation allows manipulation of the preboot environment. This effectively circumvents the integrity checks provided by UEFI Secure Boot, potentially allowing malicious code to run before the operating system loads.
Affected Products and Versions
The vulnerability affects Cisco UCS servers if they have UEFI Secure Boot enabled and are running a vulnerable BIOS version. Specifically, the 5000 Series Enterprise Network Compute Systems (ENCS) are listed as affected. Cisco bug IDs CSCwt77804, CSCwt77950, CSCwt77952, CSCwt78022, CSCwu42927, and CSCwu42928 are associated with this issue.
Cisco appliances based on preconfigured UCS C-Series Servers are also affected if they support UEFI Secure Boot and expose KVM or virtual KVM console access. This includes Application Policy Infrastructure Controller (APIC) Servers and Secure Firewall Management Center (FMC) Appliances. Physical KVM access is required to exploit the flaw on these specific appliances, reducing the attack vector.
What should you do?
Cisco states that there are no workarounds for this vulnerability. The only resolution is to upgrade to a fixed software release. The company has released updates that address the issue by removing UEFI Shell commands that allow memory modifications when Secure Boot is enabled. Administrators should verify their current BIOS and software versions against the advisory to determine if they are vulnerable.
What to do and how to stay safe: Cisco
- Check your inventory for Cisco UCS servers and appliances running vulnerable BIOS versions.
- Apply the latest software updates provided by Cisco to patch CVE-2026-20293.
- Restrict physical access to servers to prevent unauthenticated attackers from using the UEFI Shell.
- Monitor boot logs for unauthorized access to the UEFI Shell or unexpected preboot environment changes.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-20293?
It is a high-severity vulnerability in Cisco UCS servers and appliances that allows attackers to bypass UEFI Secure Boot by modifying memory variables via the UEFI Shell.
Can remote attackers exploit this flaw?
No, the advisory states that an attacker needs either valid user/admin credentials or physical access to the device to exploit the vulnerability.
Are there any workarounds available?
No, Cisco explicitly states that there are no workarounds and that users must apply the released software updates to resolve the issue.
