EUVD-2026-81146
GHSA-48qc-vpgr-vrxg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS: unauthenticated network attacker (PR:N/AV:N) but requires victim click (UI:R); script runs in victim's browser (scope change S:C) with limited browser-context confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
AnalysisAI
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to persuade an authenticated user of the ISE web-based management interface to click a crafted link (UI:R), so success depends on social engineering of an interface user rather than a direct server hit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity reflected cross-site scripting flaw (CVSS 6.1, CWE-79) in the Cisco ISE web-based management interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed release version is identified in the supplied intelligence, so the authoritative fix mapping must be taken from the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-Uz9VWRQ - obtain the appropriate maintenance or patch release for your ISE train (3.1.0, 3.2, 3.3, 3.4, or 3.5) from Cisco and upgrade to it, since the advisory is the vendor's single source of truth for patched builds; do not treat absence of a version number here as confirmation that no fix exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today