Cisco Identity Services Engine Software CVE-2026-20132

We need to produce a JSON object with the specified fields. Let's begin by examining all provided data.

CVE-2026-20132: Cisco Identity Services Engine (ISE) web management interface XSS vulnerabilities. CVSS 3.1: 4.8, vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. CWE-79. EPSS 0.03% (10th percentile). KEV: Not mentioned in input (no KEV data). Tags: Cisco, XSS. SSVC: Exploitation none, Automatable no, Technical Impact partial. Reported by Cisco. Affected versions list from EUVD: many versions of ISE software. References: Cisco advisory, NVD link.

I need to create a synthesis: summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. All strings, no arrays/objects. Product name: "Cisco Identity Services Engine". That's specific. Summary: "Stored and reflected cross-site scripting in Cisco ISE web management interface allows authenticated admins with write privileges to inject script into pages, enabling session theft or phishing if user clicks a malicious link." But careful: summary must not start with "A vulnerability", must start with specific impact verb and product. So: "Cross-site scripting in Cisco Identity Services Engine 3.1–3.4 web interface enables authenticated administrative attackers to execute arbitrary JavaScript in other users' browsers, potentially stealing session tokens or sensitive data." Use all data: authenticated remote attacker with admin write privileges, stored/reflected XSS, user interaction required. EPSS 0.03% low, not actively exploited (no KEV, SSVC exploitation none). So mention that no known active exploitation, low EPSS. I'll craft: "Cross-site scripting in the web management interface of Cisco Identity Services Engine (ISE) versions 3.1.0 through 3.4.1 allows an authenticated attacker with administrative write privileges to inject arbitrary JavaScript via stored or reflected XSS. An attacker could exploit this by tricking another admin into clicking a crafted link, leading to session hijacking or data theft, though no active exploitation is known and the EPSS score is very low (0.03%)." That's good summary.

Technical context: underlying technology: web-based management interface built for network access control. CWE-79 Improper Neutralization of Input During Web Page Generation (XSS). CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:* indicates all versions. Need to mention that user-supplied data is not sanitized when stored or reflected. Root cause: insufficient sanitization of user-supplied data before including it in web page output. This is classic XSS. The interface is used by admins to manage network access policies. Refer to CWE-79. I'll explain the technology: "Cisco ISE is a network access control and policy management platform. Its web-based management interface uses client-side JavaScript and server-rendered pages. The vulnerability arises from insufficient sanitization of user-supplied input that is stored in the web page (persistent XSS) or reflected in responses, falling under CWE-79. The affected software is identified by CPE 'cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*' covering all versions."

Risk assessment: CVSS base 4.8, medium. Vector: AV:N (network exploitable) but requires high privileges (PR:H) – admin write privileges. UI:R (user interaction), scope changed (S:C) so impacts browser context of victim admin, not the ISE system itself. Confidentiality and integrity low (C:L/I:L) – can read some info and modify page content, no availability impact. EPSS 0.03% (10th percentile) – very low probability of exploitation in next 30 days. SSVC: exploitation none, automatable no, technical impact partial. POC? Not mentioned, so assume no public POC. No KEV. So overall risk: low real-world risk. High privileges needed, user interaction, only partial technical impact. Compare signals: CVSS medium, EPSS low, no active exploitation. So it's a low priority. Also need to check if there's any conflicting info: CVSS indicates network vector, which fits web interface. No conflict. So: "The CVSS score of 4.8 (Medium) reflects the requirement for high administrative privileges and user interaction, limiting the attack surface. The EPSS score of 0.03% indicates extremely low near-term exploitation probability, and CISA SSVC rates exploitation as none, automatable as no, with only partial technical impact. No public exploit or active exploitation has been observed. This vulnerability is low risk, primarily of concern if administrative credentials are compromised and social engineering succeeds."

Affected products: list from EUVD. Write a paragraph: "Cisco Identity Services Engine Software versions 3.1.0, 3.1.0 p1 through p10, 3.2.0, 3.2.0 p1 through p7, 3.3.0, 3.3 Patch 1 through 4, 3.4.0, and 3.4 Patch 1 are affected. Detailed version information can be found in Cisco advisory cisco-sa-isexss-BS8ctE7U at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U." I'll include that URL.

Remediation: Primary fix: upgrade to a patched version. The advisory reference likely has fix versions, but I don't have explicit fix version in input data. However, input says "Vendor-released patch: [exact version]" if known. In this case, we don't have exact version from the provided data. But I can state: "Cisco has released software updates that address these vulnerabilities. Administrators should refer to the Cisco advisory (cisco-sa-isexss-BS8ctE7U) for exact fixed releases and upgrade instructions. As a workaround, restrict administrative access to trusted networks and enforce strong authentication, and educate admins not to click untrusted links within the management interface." I'll add that no partial workaround like disabling features is specified. So: "Cisco has released patches; affected users should upgrade to a fixed version as detailed in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U. If immediate patching is not possible, restrict access to the management interface to trusted administrators only and implement content security policies, though such measures do not fully mitigate injected scripts already stored."

Exploit scenario: Because requires high privileges, scenario: An attacker gains administrative access (perhaps through credential theft or phishing) to the ISE management console. The attacker then crafts a stored XSS payload in a configuration page (e.g., in a policy name or description) that executes when another admin views that page, stealing session cookies or performing actions. A reflected XSS could be delivered via a link sent to a different admin. POC not noted, so generic. "After compromising an admin account, an attacker could inject malicious JavaScript into an ISE configuration page (e.g., policy names). When another administrator views the affected page, the script executes in their browser session, potentially exfiltrating authentication tokens or manipulating ISE settings." I'll mention that this requires convincing a user to view the page/link.

Exploitation conditions: CRITICAL FIELD. Specific prerequisites from description: "authenticated, remote attacker with administrative write privileges" and "convincing a user of the interface to click a specific link or view an affected web page". So conditions: The attacker must have valid administrative credentials with write access to the management interface. Additionally, the attack depends on user interaction: another administrative user must be lured into clicking a crafted link (reflected) or viewing a page where malicious content is stored (stored). There is no mention of non-default configuration beyond admin access. So I'll state: "Requires an authenticated administrative user with write privileges to the ISE web management interface to inject the XSS payload. Successful exploitation also requires tricking a victim administrator into clicking a malicious link or viewing a compromised page; the victim must be authenticated to the same management interface. The vulnerability does not require any additional non-default configuration, but the attacker's account must have write permissions." No generic phrases.

Attack chain: Steps: Authenticated admin access (via stolen credentials) → inject malicious script via stored input or generate reflected link → deliver link/page to victim admin → victim interacts (clicks/view) → script executes in victim's browser context → exfiltrate session data or manipulate interface. Kill chain: Access (gain admin credentials) → Persist/Install (inject stored payload) → Delivery (social engineering) → Exploit (user clicks) → Execution (script runs) → Impact (data theft). Use short steps with arrows. So: "Compromise administrative credentials → Access ISE management interface → Inject stored XSS payload in configuration fields or craft reflected XSS URL → Deliver malicious link or lure victim admin to affected page → Victim clicks link or views page → Payload executes in victim’s browser session → Steal session tokens or sensitive data." That's 7 steps, but okay. I'll keep it concise: "Gain administrative access to ISE → Inject stored XSS payload → Trick another admin into viewing affected page → Script executes in victim’s browser → Capture session token or perform actions." Five steps with arrow separation.

Confidence notes: What's confirmed: vendor (Cisco) reported and published advisory. NVD entry exists. CVSS vector provided by Cisco. SSVC from CISA. EUVD list of affected versions. What's inferred: We infer that all versions listed are vulnerable until patched; exact patch numbers not in our input. POC status: no public exploit identified, not in KEV. So: "Cisco advisory confirms the vulnerability and affected versions. NVD and EUVD list versions; no evidence of public exploit or active exploitation (no KEV, SSVC exploitation none). Exact fixed versions are referenced in the Cisco advisory but not independently verified here." Good.

Prevalence: Cisco ISE is widely used in enterprise networks for network access control. It's a common enterprise product, but not as ubiquitous as Windows or Linux kernel. I'd say "medium" because it's a specific network security appliance deployed in many large organizations, but not everywhere. Prevalence basis: "widely deployed network access control platform in enterprise environments". So prevalence: medium, prevalence_basis: "widely deployed enterprise NAC appliance". But need to be careful: Cisco ISE is a major product in the NAC space, common in large enterprises, so "medium" might be appropriate. Could also be "high" for enterprise environments? I'll stick with medium, as not every company uses NAC. So: prevalence "medium", basis "widely deployed enterprise network access control platform".

Assessed CVSS vector: My own independent vector. Given the description: attacker needs administrative write privileges (PR:H), user interaction required (UI:R), scope changed because the script executes in the victim's browser context (S:C), impacts confidentiality and integrity of that context (C:L/I:L) and no availability (A:N). Attack vector is network (AV:N) because web interface accessible remotely. Attack complexity low (AC:L) because XSS injection straightforward. So same as original: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. But I need to justify: "Requires high privileges and user interaction, with limited impact on confidentiality and integrity in victim’s browser." That's good. So output that vector.

Assessed CVSS 4.0 vector: Need to map. CVSS 4.0 base: AV:N (Network), AC:L (Low), AT:N (Attack Requirements None, since no special conditions beyond attack), PR:H (High), UI:R (Required). VC: L (low confidentiality impact on vulnerable system? Actually, the vulnerable system is the ISE management interface but the impact is on the viewing user's browser context, which is considered a subsequent system. In CVSS 4.0, vulnerable system (VC/VI/VA) is the ISE itself? Wait, the description: script is executed in the context of the web-based management interface or allow attacker to access sensitive browser-based information. So the vulnerable system is the ISE web application, but the exploited vulnerability allows attacker to execute script in the victim's browser, which is a separate system. In CVSS 3.1, scope changed (S:C) indicates the vulnerable component (ISE web) and impacted component (browser context) are different. In CVSS 4.0, the base metrics use VC/VI/VA for the vulnerable system, and SC/SI/SA for subsequent system. For XSS, usually the vulnerable system's confidentiality and integrity