EUVD-2026-53448
GHSA-pm96-2768-2263
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker obtains high-privilege IMC credentials
-
DeliveryCraft malicious XSS link targeting IMC parameter
-
ExploitDeliver link to active IMC user via phishing or social engineering
-
ExecutionVictim clicks link in authenticated browser session
-
PersistInjected script executes in victim's IMC browser context
-
ImpactSteal session tokens or sensitive browser-based data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be authenticated to the Cisco IMC web management interface with high-level privileges (confirmed by CVSS PR:H). The targeted victim must also be an active user of the same IMC web interface and must be persuaded to click a crafted link (CVSS UI:R), introducing a social engineering dependency. Both parties must have access to the IMC interface, which is typically an out-of-band server management plane not exposed to the public internet. What limits exploitation: the attacker cannot leverage this vulnerability as an initial access vector - they must already possess valid high-privilege IMC credentials; the attack cannot be automated without the user-interaction step; and the IMC interface is typically only reachable on isolated management networks, further constraining attacker access. The vulnerability does not enable lateral movement beyond the browser context of the targeted user. |
| Impact | The CVSS 3.1 base score of 4.8 (Medium) reflects the significant attack prerequisites encoded in the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. PR:H requires the attacker to already hold high-privilege credentials on the IMC interface before they can conduct the attack; this substantially limits the realistic attacker population to insiders, compromised admin accounts, or lateral-movement scenarios. UI:R adds a social engineering dependency. The scope change (S:C) elevates the score modestly, reflecting that injected script runs in the victim's browser context. No EPSS data was provided in the input, but given the authentication prerequisites and absence of both KEV listing and public exploit code, the probability of widespread automated exploitation is assessed as very low. This is a real but low-urgency finding: it enables session hijacking or credential theft against other IMC admin users, which is meaningful in a shared-admin environment but not an externally-exploitable initial access vector. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege credentials on the Cisco IMC web interface crafts a URL containing a malicious JavaScript payload exploiting the unsanitized input parameter. The attacker then sends this link to another administrator currently authenticated to the IMC interface - via email, chat, or a shared ticketing system - and the victim clicks it. The script executes in the victim's browser session, enabling the attacker to exfiltrate session cookies, capture credentials, or perform management actions under the victim's identity. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.
RemediationAI
The primary remediation is to apply the fixed software version identified in Cisco Security Advisory cisco-sa-cimc-xss-7EhBFxBp, available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp. Exact fixed version numbers are not independently confirmed in the provided input data beyond the advisory reference; consult the advisory directly for the recommended upgrade target per product line. As a compensating control where immediate patching is not feasible, restrict access to the IMC web management interface to a dedicated out-of-band management network or VPN segment, and enforce the principle of least privilege by limiting the number of accounts with high-privilege IMC access - this directly reduces the attacker population that could exploit PR:H. Note that restricting network access does not eliminate the vulnerability but substantially reduces exposure. Disabling the web-based IMC interface in favor of CLI-only management would eliminate the attack surface entirely, at the cost of losing the graphical hardware management capability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected back into the HTML response without adequate encoding or sanitization. The CVSS scope-change metric (S:C) reflects the defining characteristic of stored or reflected XSS: the injected script executes in the browser security context of the victim, potentially crossing the origin boundary of the management application. Affected products confirmed via CPE and EUVD data span three Cisco platforms: Cisco Enterprise NFV Infrastructure Software (NFVIS), Cisco Unified Computing System Standalone (rack-mount servers), and Cisco UCS E-Series Software (UCSE) - all of which embed the IMC web management interface for out-of-band hardware administration.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Vendor vector is independently supported: network-accessible web UI, high privilege prerequisite, required user click, and browser-context scope change with limited C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code exe
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB