EUVD-2026-17940Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
AnalysisAI
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject malicious script code that executes in the browsers of other users accessing the interface. An attacker with administrative credentials can exploit insufficient input validation by crafting a malicious link and tricking a user into clicking it, enabling arbitrary script execution or theft of sensitive browser-based information. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability exists in Cisco IMC (Integrated Management Controller), a web-based management interface for Cisco UCS (Unified Computing System) infrastructure. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). Cisco IMC is the management platform for various Cisco enterprise infrastructure products including UCS standalone systems and ENFI (Enterprise NFV Infrastructure) deployments. The insufficient input validation in the web interface allows user-supplied input to be stored and subsequently rendered without proper sanitization, leading to stored XSS. The vulnerability affects multiple Cisco product lines that rely on IMC for management operations.
RemediationAI
Organizations should consult the official Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for specific patched versions and upgrade instructions. Patch availability has not been independently confirmed from the provided data; vendors typically release updated firmware/software builds that address input validation in the IMC management interface. As an interim measure, restrict administrative access to the IMC web interface to trusted networks only, enforce strong authentication controls on administrative accounts, and conduct security awareness training to reduce the likelihood of administrators clicking malicious links. Monitor IMC access logs for suspicious script injection attempts in managed resources or configuration changes.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today