A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Metrics
Affected Vendors & Products
References
History
Fri, 03 Apr 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco enterprise Nfv Infrastructure Software Cisco unified Computing System Cisco unified Computing System Software |
|
| Vendors & Products |
Cisco
Cisco enterprise Nfv Infrastructure Software Cisco unified Computing System Cisco unified Computing System Software |
Wed, 01 Apr 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information. | |
| Title | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: cisco
Published: 2026-04-01T16:34:40.865Z
Updated: 2026-04-01T17:50:56.617Z
Reserved: 2025-10-08T11:59:15.367Z
Link: CVE-2026-20087
Updated: 2026-04-01T17:50:13.157Z
Status : Awaiting Analysis
Published: 2026-04-01T17:28:26.863
Modified: 2026-04-03T16:11:11.357
Link: CVE-2026-20087
No data.