EUVD-2026-17939
GHSA-73qp-24hp-vph8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 base score of 4.8 reflects medium severity with low impact scope. The vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) indicates network accessibility and low attack complexity, but critically requires high privilege (admin) and user interaction (UI:R), which substantially reduces real-world exploitability. The attack requires an administrator to intentionally craft and deploy malicious input, then deceive other users into accessing it-a scenario requiring significant social engineering and insider threat capability rather than external opportunistic exploitation. The confidentiality and integrity impacts are rated low, limiting damage to cross-site scripting effects (session hijacking, credential theft, data exfiltration) rather than system compromise. EPSS data is not provided, but the privilege and interaction requirements place this in the lower-risk category despite the network vector. This is a real vulnerability requiring remediation but should not be treated as an emergency-it is a privilege-abuse and social-engineering vector rather than a critical remote code execution pathway. |
| Exploit ScenarioDerived | An insider with legitimate administrative access to a Cisco UCS or NFV Infrastructure system crafts a malicious URL containing XSS payload embedded in a management interface parameter, then sends the link to another administrator or operator via email or chat, claiming it references an important system alert. When the victim clicks the link and views the page, the stored script executes in their browser, allowing the attacker to steal their session cookie, redirect them to a credential harvesting page, or silently exfiltrate configuration data. No public proof-of-concept code has been identified, and the attack requires both administrative privileges and successful social engineering to initiate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via insufficient input validation. Attackers with admin privileges can craft malicious links that execute JavaScript in the browsers of other users accessing the interface, potentially compromising session security, stealing credentials, or accessing sensitive information. No public exploit code or active exploitation has been confirmed; the vulnerability requires administrator privileges and user interaction to trigger.
RemediationAI
Apply the vendor-released security patch from Cisco as described in security advisory cisco-sa-cimc-xss-A2tkgVAB. Review the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for exact patched versions and upgrade instructions specific to your IMC deployment (Enterprise NFV Infrastructure, Standalone UCS, or UCSE). As an interim mitigation, restrict administrative access to the IMC web interface to trusted personnel only, enforce strong authentication and session management practices, and educate administrators to avoid clicking suspicious links provided by other users within the management interface. Monitor IMC access logs for unusual administrative activity or injection attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the web-based management interface of Cisco Integrated Management Controller (IMC), which is a baseboard management controller embedded in Cisco UCS systems and Enterprise NFV Infrastructure Software. The root cause is insufficient validation of user-supplied input (CWE-79: Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). When an authenticated administrator provides input through the interface without proper encoding or sanitization, malicious script payloads persist in the application's data store and are executed in the context of other users' browsers when they view the affected content. The attack surface is limited to the web interface accessible to administrators, leveraging the browser's same-origin policy vulnerability through stored injection rather than reflected XSS.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB