EUVD-2026-17943Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
AnalysisAI
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject persistent malicious scripts that execute in other users' browsers via crafted links. Affects Cisco Enterprise NFV Infrastructure Software, Unified Computing System (standalone), and UCS E-Series. No public exploit code or active exploitation confirmed; patch availability not independently verified from provided data.
Technical ContextAI
The vulnerability resides in the web-based management interface component of Cisco Integrated Management Controller (IMC) software, which provides administrative access to Cisco's converged infrastructure platforms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation-'Cross-site Scripting'), stemming from insufficient validation of user-supplied input before rendering it in HTML responses. Because this is a stored XSS variant, malicious payloads persist in the application's data store and are served to all users who access the affected functionality, creating a persistent attack surface. The attack requires administrative credentials (PR:H in CVSS vector) but leverages user interaction (UI:R) via social engineering to trigger payload execution in victims' browsers. The CPE data identifies three distinct Cisco product lines affected: Enterprise NFV Infrastructure Software, UCS Standalone, and UCS E-Series platforms-all sharing the vulnerable IMC management interface codebase.
RemediationAI
Apply the vendor-released security patch from Cisco. Consult Cisco Security Advisory cisco-sa-cimc-xss-A2tkgVAB (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB) for exact patched software versions for each affected product line (Enterprise NFV Infrastructure Software, UCS Standalone, and UCSE). As an interim mitigating control, restrict administrative access to IMC management interfaces to trusted users and networks, implement Content Security Policy headers if configurable, and educate administrative staff to avoid clicking untrusted links referencing IMC. Disable unnecessary IMC features if not in active use.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today