EUVD-2026-15442Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 score of 4.8 is moderate, multiple factors contextualize the actual risk: The attack vector is network-based with low complexity and requires high privileges (administrator credentials) plus user interaction, placing this in the lower-risk category for typical deployments. However, the stored XSS nature means the attack persists and affects multiple users, increasing the real-world impact in environments with multiple administrators. The EUVD listing of 353 vulnerable versions spanning from 2016 release lines (16.6.1) through 2026 releases (17.18.1) indicates this is a systemic issue across Cisco's entire IOS XE portfolio affecting potentially thousands of deployed devices. The requirement for valid administrative credentials significantly limits exploitation scope compared to unauthenticated XSS. The presence of a Cisco security advisory (referenced at sec.cloudapps.cisco.com) and EUVD tracking suggest this is a documented, vendor-acknowledged issue with patch availability. In environments with strong administrative access controls and no hostile insiders, risk remains moderate; however, in organizations with numerous administrators, contractors, or weak credential hygiene, this becomes a higher-priority remediation target due to the persistent nature of stored XSS and potential for session hijacking or sensitive data theft. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials (obtained through social engineering, credential stuffing, or insider threat) logs into the IOx management web interface and injects a malicious JavaScript payload into a user input field on a configuration page (such as application name, description, or settings). The payload is stored in the application database without proper sanitization. When other administrators subsequently access that same configuration page to manage IOx applications, the malicious script executes in their browser context with their privilege level, allowing the attacker to steal session cookies, CSRF tokens, or sensitive configuration data, or to perform unauthorized administrative actions on their behalf. This is particularly dangerous in production environments where multiple network engineers access the same management interface and may not notice the attack occurring in their browser session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A stored cross-site scripting (XSS) vulnerability exists in the web-based Cisco IOx application hosting environment management interface within Cisco IOS XE Software, allowing authenticated remote attackers with administrative credentials to inject malicious scripts that execute in the context of other users' browser sessions. Successful exploitation enables arbitrary script execution and access to sensitive browser-based information affecting a wide range of Cisco IOS XE versions from 16.6.1 through 17.18.1a. This vulnerability requires valid administrative credentials and user interaction but poses a significant risk in multi-administrator environments where privilege escalation or lateral movement could occur.
RemediationAI
Upgrade Cisco IOS XE Software to a patched version released after the vulnerability disclosure date; consult the official Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-xss-LpGkzwtJ for specific patched version numbers corresponding to your release train. Until patching is possible, implement the following compensating controls: restrict administrative web interface access via network access control lists (ACLs) to trusted administrative networks only; enforce HTTPS with valid certificates and implement HTTP Strict-Transport-Security (HSTS) headers; disable the IOx application hosting feature if not in use; implement strong multi-factor authentication (MFA) for all administrative accounts to reduce the likelihood of credential compromise; monitor access logs for suspicious administrative activities or XSS payload signatures; and consider deploying a reverse proxy or WAF in front of the management interface to filter and sanitize HTTP requests. Regular patching of IOS XE software should be included in the standard maintenance window schedule to prevent accumulation of known vulnerabilities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the IOx application hosting environment management interface, a web-based administrative portal integrated into Cisco IOS XE Software (CPE: cpe:2.3:a:cisco:cisco_ios_xe_software). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input validation and output encoding on specific interface pages. The IOx subsystem is Cisco's lightweight virtualization platform for running containerized applications on IOS XE devices. When user-supplied input is not properly sanitized before being stored in the application database and subsequently rendered in HTML responses, an attacker can craft malicious payloads that persist and execute whenever other authenticated users access the affected pages. The vulnerability affects the web interface served by the IOS XE management plane, not the underlying routing or switching functions.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Executive ViewAI
CVE-2026-20112 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB