CVE-2026-20293

CVE-2026-20293 is a flaw in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances that lets an attacker bypass UEFI Secure Boot validation and run unauthorized software. It is triggered because memory-write commands remain available in the UEFI Shell even while Secure Boot is enabled: an attacker selects the UEFI Shell boot option at boot time and uses shell commands to modify UEFI memory variables and overwrite Secure Boot-related memory values. A successful exploit manipulates the preboot environment and allows execution of untrusted software that would normally be rejected by Secure Boot. Exploitation requires either physical access (no credentials needed) or valid credentials for an account with the user or admin role on the affected system, so practical exposure is limited to systems where an attacker has local access. No exploitation in the wild, public proof-of-concept, or KEV listing is known, and EPSS puts 30-day exploitation probability at about 0.1%.

What to do: Upgrade UCS server and appliance firmware to the fixed releases listed in the Cisco PSIRT advisory for CVE-2026-20293 (specific versions are not included in the data provided). Until patched, restrict physical access to UCS hosts, limit local user/admin credentials, and restrict or remove the UEFI Shell option from the boot menu so it cannot be selected at boot time. Because exploitation requires local access and there is no known in-the-wild exploitation, prioritize systems that are physically accessible or widely shared (e.g., branch or lab locations).