EUVD-2026-17939
GHSA-73qp-24hp-vph8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
AnalysisAI
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via insufficient input validation. Attackers with admin privileges can craft malicious links that execute JavaScript in the browsers of other users accessing the interface, potentially compromising session security, stealing credentials, or accessing sensitive information. No public exploit code or active exploitation has been confirmed; the vulnerability requires administrator privileges and user interaction to trigger.
Technical ContextAI
The vulnerability exists in the web-based management interface of Cisco Integrated Management Controller (IMC), which is a baseboard management controller embedded in Cisco UCS systems and Enterprise NFV Infrastructure Software. The root cause is insufficient validation of user-supplied input (CWE-79: Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). When an authenticated administrator provides input through the interface without proper encoding or sanitization, malicious script payloads persist in the application's data store and are executed in the context of other users' browsers when they view the affected content. The attack surface is limited to the web interface accessible to administrators, leveraging the browser's same-origin policy vulnerability through stored injection rather than reflected XSS.
RemediationAI
Apply the vendor-released security patch from Cisco as described in security advisory cisco-sa-cimc-xss-A2tkgVAB. Review the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for exact patched versions and upgrade instructions specific to your IMC deployment (Enterprise NFV Infrastructure, Standalone UCS, or UCSE). As an interim mitigation, restrict administrative access to the IMC web interface to trusted personnel only, enforce strong authentication and session management practices, and educate administrators to avoid clicking suspicious links provided by other users within the management interface. Monitor IMC access logs for unusual administrative activity or injection attempts.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today