EUVD-2026-17943Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite a moderate CVSS score of 4.8, this vulnerability presents limited real-world risk due to multiple constraining factors. The attack vector requires high-privilege authentication (administrative access), eliminating threats from unauthenticated network attackers and significantly reducing exposure in organizations with strong access controls. User interaction is mandatory (UI:R), forcing attackers to socially engineer targets into clicking malicious links-a barrier that reduces effectiveness compared to direct exploitation. The impact is limited to confidentiality and integrity with no availability impact (C:L/I:L/A:N), and the scope is changed (S:C) but the browser-sandbox context constrains lateral damage. No EPSS data provided, but exploitation probability appears low given authentication and interaction barriers. Absence of CISA KEV status and public exploit code indicates minimal active exploitation. Priority should be lower than high-CVSS remote code execution flaws, but remediation is still warranted for organizations with sensitive administrative workflows in IMC. |
| Exploit ScenarioDerived | An attacker with administrative access to an IMC interface crafts a malicious URL containing a stored XSS payload targeting a specific management function and sends it to another administrator via email or chat. When the targeted administrator clicks the link while authenticated to IMC, the injected JavaScript executes in their browser session, potentially stealing administrative cookies, session tokens, or sensitive configuration data displayed on the page. Execution is limited to the browser context and the attacker's ability to persuade legitimate administrators to click the link, making opportunistic mass exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject persistent malicious scripts that execute in other users' browsers via crafted links. Affects Cisco Enterprise NFV Infrastructure Software, Unified Computing System (standalone), and UCS E-Series. No public exploit code or active exploitation confirmed; patch availability not independently verified from provided data.
RemediationAI
Apply the vendor-released security patch from Cisco. Consult Cisco Security Advisory cisco-sa-cimc-xss-A2tkgVAB (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB) for exact patched software versions for each affected product line (Enterprise NFV Infrastructure Software, UCS Standalone, and UCSE). As an interim mitigating control, restrict administrative access to IMC management interfaces to trusted users and networks, implement Content Security Policy headers if configurable, and educate administrative staff to avoid clicking untrusted links referencing IMC. Disable unnecessary IMC features if not in active use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the web-based management interface component of Cisco Integrated Management Controller (IMC) software, which provides administrative access to Cisco's converged infrastructure platforms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation-'Cross-site Scripting'), stemming from insufficient validation of user-supplied input before rendering it in HTML responses. Because this is a stored XSS variant, malicious payloads persist in the application's data store and are served to all users who access the affected functionality, creating a persistent attack surface. The attack requires administrative credentials (PR:H in CVSS vector) but leverages user interaction (UI:R) via social engineering to trigger payload execution in victims' browsers. The CPE data identifies three distinct Cisco product lines affected: Enterprise NFV Infrastructure Software, UCS Standalone, and UCS E-Series platforms-all sharing the vulnerable IMC management interface codebase.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
GitHub PoC
Exploit-DB