EUVD-2026-22958Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Admin write privileges required (PR:H), victim interaction mandatory (UI:R); scope change reflects XSS browser-boundary crossing; no availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.
These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
AnalysisAI
Stored and reflected cross-site scripting vulnerabilities in Cisco Identity Services Engine's web-based management interface allow an authenticated attacker holding administrative write privileges to inject malicious JavaScript that executes in the context of other users' browsers. Affected releases span ISE 3.1 through 3.4 (including multiple patch releases). No active exploitation has been identified and no public exploit code exists; the EPSS score of 0.03% and SSVC exploitation status of 'none' align with the high privilege bar required.
Technical ContextAI
Cisco Identity Services Engine (ISE) is an enterprise network access control (NAC) and policy management platform. The affected component is its web-based management interface, which fails to sufficiently sanitize user-supplied data before storing it in or reflecting it from rendered web pages - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation). Two distinct XSS sub-classes are present: stored XSS, where injected content persists server-side and executes whenever the page is loaded by any user, and reflected XSS, where a crafted URL carries the payload that executes only when a victim clicks the link. The CVSS S:C (Scope Changed) metric reflects the standard XSS characteristic that injected scripts cross the browser's same-origin security boundary, executing in the victim browser's context rather than solely in the application's security domain. CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software.
RemediationAI
Consult the Cisco Security Advisory (cisco-sa-isexss-BS8ctE7U) at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U for fixed software releases; exact patched version numbers are not independently confirmed from the available data and should be verified directly with Cisco. As a compensating control, restrict administrative write access to the ISE management interface to the minimum necessary set of trusted accounts and enforce multi-factor authentication on those accounts, which raises the bar for an attacker obtaining the prerequisite privileges. Browser-level XSS mitigations such as a Content Security Policy header (if configurable in ISE) can reduce the impact of injected scripts. Monitoring admin-level logins and management interface access logs for anomalous activity provides detection coverage.
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unaut
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to i
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, aut
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authentica
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADI
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today