EUVD-2026-17940Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 score of 4.8 reflects a medium-severity vulnerability with specific limiting factors: network-based attack vector (AV:N) and low complexity (AC:L) are offset by the requirement for high-privilege authentication (PR:H) and user interaction (UI:R). The scope is changed (S:C), allowing impact beyond the vulnerable component. While confidentiality and integrity impacts are classified as low (C:L, I:L), the practical risk depends on the sensitivity of data accessible through the IMC interface in target environments. EPSS score not provided; however, the authentication barrier (administrative privileges required) and user-interaction requirement significantly reduce real-world exploitation probability compared to the CVSS base score suggests. This is a lower-priority vulnerability for most organizations unless administrative accounts are compromised or insider threats are a concern. The limitation to authenticated administrators with high privileges substantially mitigates widespread risk compared to unauthenticated XSS vulnerabilities. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials (or who has compromised an admin account) could craft a link containing malicious JavaScript payload and send it to other authorized IMC users via email or social engineering. When a legitimate user clicks the link and accesses the IMC interface, the stored XSS payload executes in their browser, potentially stealing session tokens, administrative credentials, or sensitive infrastructure configuration data. The attack requires user interaction and administrative-level initial access, limiting its appeal for mass exploitation but making it a credible threat in environments with compromised admin accounts or insider threat concerns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject malicious script code that executes in the browsers of other users accessing the interface. An attacker with administrative credentials can exploit insufficient input validation by crafting a malicious link and tricking a user into clicking it, enabling arbitrary script execution or theft of sensitive browser-based information. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Organizations should consult the official Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for specific patched versions and upgrade instructions. Patch availability has not been independently confirmed from the provided data; vendors typically release updated firmware/software builds that address input validation in the IMC management interface. As an interim measure, restrict administrative access to the IMC web interface to trusted networks only, enforce strong authentication controls on administrative accounts, and conduct security awareness training to reduce the likelihood of administrators clicking malicious links. Monitor IMC access logs for suspicious script injection attempts in managed resources or configuration changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Cisco IMC (Integrated Management Controller), a web-based management interface for Cisco UCS (Unified Computing System) infrastructure. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). Cisco IMC is the management platform for various Cisco enterprise infrastructure products including UCS standalone systems and ENFI (Enterprise NFV Infrastructure) deployments. The insufficient input validation in the web interface allows user-supplied input to be stored and subsequently rendered without proper sanitization, leading to stored XSS. The vulnerability affects multiple Cisco product lines that rely on IMC for management operations.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authentication bypass in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to gain ad
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
GitHub PoC
Exploit-DB