Riskcovery

CVE-2026-20090

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

State
Published
Severity
4.8 Medium
Published
Apr 1, 2026
Updated
Apr 22, 2026
Reserved
Oct 8, 2025

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:Ncisco

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
Cisco Enterprise NFV Infrastructure SoftwareCisco
  • 4.1.1Affected
  • 3.9.1Affected
  • 3.5.2Affected
  • 3.12.2Affected
  • 3.6.2Affected
  • 3.9.2Affected
  • 3.11.3Affected
  • 3.11.1Affected
  • 3.5.1Affected
  • 3.3.1Affected
  • 3.10.2Affected
  • 3.12.1bAffected
  • 3.4.1Affected
  • 3.12.1aAffected
  • 3.6.3Affected
  • 3.8.1Affected
  • 3.11.2Affected
  • 3.12.1Affected
  • 3.12.3Affected
  • 3.10.1Affected
  • 3.6.1Affected
  • 3.10.3Affected
  • 3.7.1Affected
  • 4.1.2Affected
  • 4.2.1Affected
  • and 44 more versions
Cisco Unified Computing System (Standalone)Cisco
  • 4.0(2g)Affected
  • 3.1(2i)Affected
  • 3.1(1d)Affected
  • 4.0(4i)Affected
  • 4.1(1c)Affected
  • 4.0(2c)Affected
  • 4.0(1e)Affected
  • 4.0(2h)Affected
  • 4.0(4h)Affected
  • 4.0(1h)Affected
  • 4.0(2l)Affected
  • 3.1(3g)Affected
  • 4.0(1.240)Affected
  • 4.0(2f)Affected
  • 4.0(1g)Affected
  • 4.0(2i)Affected
  • 3.1(3i)Affected
  • 4.0(4d)Affected
  • 4.1(1d)Affected
  • 3.1(3c)Affected
  • 4.0(4k)Affected
  • 3.1(2d)Affected
  • 3.1(3a)Affected
  • 3.1(3j)Affected
  • 4.0(2d)Affected
  • and 125 more versions
Cisco Unified Computing System E-Series Software (UCSE)Cisco
  • 3.2.7Affected
  • 3.2.6Affected
  • 3.2.4Affected
  • 3.2.10Affected
  • 3.2.2Affected
  • 3.2.3Affected
  • 2.4.0Affected
  • 3.2.1Affected
  • 3.2.11.1Affected
  • 3.2.8Affected
  • 3.1.1Affected
  • 3.0.2Affected
  • 2.1.0Affected
  • 2.2.2Affected
  • 3.1.2Affected
  • 3.0.1Affected
  • 2.3.2Affected
  • 2.3.5Affected
  • 2.2.1Affected
  • 3.1.4Affected
  • 2.4.1Affected
  • 2.3.1Affected
  • 3.1.3Affected
  • 2.3.3Affected
  • 2.4.2Affected
  • and 17 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.