Cisco Identity Services Engine Software
Monthly
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to execute arbitrary operating system commands via crafted HTTP requests, resulting in full root access. The vulnerability, rated 9.9 (Critical), impacts multiple ISE versions; in single-node deployments, the affected device may become unavailable, causing denial of service. No active exploitation (KEV) or public exploit code has been identified, and the EPSS score of 0.21% indicates low likelihood of widespread attacks.
We need to produce a JSON with specific fields. The input: CVE-2026-20186, a Cisco ISE vulnerability. Description says: authenticated, remote attacker with Read Only Admin to execute arbitrary commands on OS. Insufficient input validation, crafted HTTP request, user-level access then elevate to root. In single-node deployments, DoS possible. CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-77: Command Injection. EPSS 0.23% (46th percentile). KEV status not in input? Input does not mention KEV. Tags: Denial Of Service, Cisco, Command Injection, Cisco Identity Services Engine Software. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD lists many affected versions. CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*. References: Cisco advisory, NVD, vuldb. No mention of POC or KEV in the multi-source intelligence. SSVC says exploitation: none and automatable: no (so no active exploitation, not automatable). So the exploitation status is "no public exploit identified at time of analysis". No KEV listing. We must synthesize all data. product_name: "Cisco Identity Services Engine Software" but maybe just "Cisco ISE"? The description says "Cisco Identity Services Engine (ISE)". So "Cisco Identity Services Engine" but too long? "Cisco ISE" might be recognized. "Cisco Identity Services Engine" is primary. I'll use "Cisco ISE" as product_name (1-3 words). "Cisco ISE" is okay (2 words). I'll use "Cisco ISE". But I can also say "Cisco Identity Services Engine Software". Three words: "Cisco ISE Software"? "Cisco ISE" is clear. Summary: Not copy description. Start with impact verb. Example: "Command injection in Cisco ISE allows authenticated remote attacker with Read-Only Admin privileges to achieve OS command execution and privilege escalation to root, leading to total compromise and potential denial of service." Use EPSS, KEV? No KEV, EPSS low (0.23%), so not actively exploited. So: "A command injection vulnerability in Cisco Identity Services Engine (ISE) allows an authenticated attacker with Read-Only Admin privileges to execute arbitrary commands on the underlying OS via crafted HTTP requests, potentially escalating to root. Successful exploitation can lead to full device compromise and, in single-node deployments, a denial-of-service condition. Cisco has released a patch." No active exploitation. I'll incorporate EPSS: low exploitation probability. So: "Command injection in Cisco Identity Services Engine (ISE) allows an authenticated remote attacker with Read-Only Admin credentials to execute arbitrary commands on the underlying operating system via crafted HTTP requests, leading to full compromise with root access and, in single-node deployments, denial of service. Although the CVSS score is 9.9 (critical), EPSS indicates low exploitation probability (0.23%) and no active exploitation has been observed." That's good. technical_context: Explain underlying tech, CWE-77 (Command Injection). Cisco ISE is a network access control policy engine. The vulnerability is command injection due to insufficient input validation. CPE indicates software versions. Reference CWE-77. So: "Cisco Identity Services Engine is a security policy management platform that controls network access. This vulnerability is a command injection (CWE-77) arising from insufficient validation of user input processed by the ISE web interface. The attacker can inject arbitrary commands that are executed on the underlying Linux-based operating system. Affected software versions include multiple patches of Cisco ISE 3.1, 3.2, 3.3, and 3.4 as listed in ENISA EUVD." I'll mention CPE. risk_assessment: Use CVSS vector, EPSS, SSVC, KEV (none), POC (none). Compare signals: CVSS 9.9 Critical, but PR:L (read-only admin), so authentication is needed; attack complexity low, scope changed, so high impact. EPSS 0.23% is low, percentile 46% (so below median). SSVC: exploitation none, automatable no, so not currently being exploited, and not easily automated. So real-world risk is moderate: requires authenticated access with at least Read-Only Admin, which is not trivial, but if compromised, full control. So: "CVSS 9.9 indicates a critical severity due to network vector, low attack complexity, low privileges, and scope change leading to high impacts. However, exploitation requires an attacker to have Read-Only Admin privileges (PR:L), which limits the pool of potential attackers to those who can obtain such credentials. EPSS score of 0.23% (46th percentile) suggests low likelihood of widespread exploitation in the wild. SSVC analysis shows no current exploitation and not automatable, further reducing the immediate urgency. Although the impact is total compromise, the need for authenticated access to the management interface lowers the real-world risk, though organizations with exposed admin interfaces or weak credential hygiene face higher risk." I need to note conflicting or missing data: no active exploitation, patch available. No conflicting signals. affected_products: List versions from EUVD enumeration. "Cisco Identity Services Engine Software versions 3.1.0 through 3.4 Patch 3 are affected. Specifically, multiple patch levels of 3.1, 3.2, 3.3, and 3.4 as listed by ENISA EUVD are vulnerable. The Cisco security advisory (cisco-sa-ise-rce-4fverepv) provides full details and fixed releases." I'll reference advisory URL. remediation: "Cisco has released software updates to address this vulnerability; upgrades to the latest patched versions are recommended. Refer to the Cisco advisory cisco-sa-ise-rce-4fverepv for specific fixed versions (e.g., 3.1.0 Patch 10 or later, 3.2.0 Patch 7 or later, 3.3 Patch 7 or later, 3.4 Patch 3 or later). As a workaround, restrict network access to the ISE management interface to trusted IPs only, and enforce strong credential policies to prevent unauthorized read-only admin access. However, these are compensating controls; applying the vendor patch is the definitive solution." Since the vulnerability requires authenticated access, restricting admin interface access can help. exploit_scenario: "An attacker who has obtained Read-Only Admin credentials (e.g., through phishing or credential reuse) could leverage the command injection via crafted HTTP request to achieve arbitrary command execution with user-level OS access, then elevate to root to take full control of the ISE node." So 2-3 sentences. exploitation_conditions: Extract concrete prerequisites: Must have at least Read-Only Admin credentials (authenticated). Attack vector is network, but exploitation requires sending crafted HTTP request to the management interface. So specific condition: "The attacker must have valid credentials with at least Read-Only Admin privileges on the Cisco ISE device’s management interface. No configuration changes are required; the vulnerability exists in the input validation of a web application component. Exploitation is limited by the need for authenticated access to the administrative web interface, making it inaccessible to unauthenticated external attackers unless credentials are obtained." Also mention that single-node deployments extra DoS condition? Not a condition for exploitation, but impact. So: "Exploitation requires valid credentials with Read-Only Admin role on the ISE management web interface, which is typically restricted to network administrators. There is no indication that default configurations or public-facing deployments without authentication are vulnerable; however, if the admin interface is exposed to the internet or accessible without multi-factor authentication, the attack surface increases." Avoid generic phrases. So: "Requires authenticated access with at least Read-Only Admin credentials on the Cisco ISE administrative HTTP interface. No other special conditions—the flaw is present in default configurations as long as the attacker can interact with the web application." That's specific. attack_chain: Use phases. Steps: Obtain Read-Only Admin credentials (recon/delivery) → Send crafted HTTP request to ISE web interface → Exploit command injection vulnerability → Execute arbitrary commands as user-level OS account → Elevate privileges to root → Achieve full compromise or denial of service. Short steps: "Obtain Read-Only Admin credentials" → "Send crafted HTTP request to ISE management web interface" → "Trigger command injection via insufficient input validation" → "Execute commands as unprivileged OS user" → "Elevate privileges to root" → "Full node compromise or single-node DoS". That's 6 steps. confidence_notes: "Cisco has confirmed the vulnerability and released a security advisory with patches. Affected versions are listed by ENISA. No active exploitation has been reported; CISA KEV does not include this CVE, and SSVC indicates exploitation: none and automatable: no. The EPSS score is 0.23%, indicating low likelihood of exploitation. The CVSS vector and description are consistent. Missing: proof of concept code is not publicly available at this time." But we don't know about POC; can say "No public exploit code has been identified at time of analysis." So: "Cisco advisory confirms the vulnerability and patch availability. No active exploitation has been observed (not in CISA KEV, SSVC exploitation: none). EPSS low. Affected versions are confirmed via EUVD and vendor advisory. No public proof-of-concept code has been released. The CVSS vector aligns with the description." That's fine. prevalence: Cisco ISE is a widely used network access control product in enterprise environments. So prevalence: "high". Justification: "Cisco ISE is a widely deployed enterprise access control solution." So prevalence_basis: "widely deployed enterprise access control solution". Good. assessed_cvss_vector: My own independent CVSS 3.1 vector. I need to adjust? I can use: AV:N (network, HTTP request), AC:L (no special complexity, just crafted request), PR:L (requires read-only admin), UI:N (no user interaction beyond the attack request), S:C (scope change, OS commands executed on underlying OS from the application component), C:H/I:H/A:H (full compromise). So replicating the given vector. I'll output "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H". That's identical. I need to justify: "Requires authenticated access (PR:L) but no user interaction and no complexity; scope change leads to full impact." So rationale: "Network vector with low complexity, low privileges (Read-Only Admin), and scope change results in total system compromise." That's good. assessed_cvss40_vector: Convert to CVSS 4.0 base vector. For base, we need AV, AC, AT, PR, UI, VC, VI, VA, SC, SI, SA. Attack Vector: Network (N). Attack Complexity: Low (L). Attack Requirements: None (N) — since no specific requirement, so AT:N. Privileges Required: Low (L). User Interaction: None (N). Vulnerable System Confidentiality: High (H) (commands executed on OS give access to data). Integrity: High (H). Availability: High (H). Subsequent System: None (N) for all, because it's the same system? Actually scope change from application to OS, but in CVSS 4.0, the Vulnerable System (the application web interface) is the first. The impact on the OS is considered a subsequent system? The vulnerable component is the web application, the subsequent system is the OS. So SC, SI, SA should reflect impact on the OS: High because full compromise. So "SC:H/SI:H/SA:H". But the CVSS 4.0 base vector uses VC/VI/VA for the vulnerable component's CIA, and SC/SI/SA for the subsequent system. So the vulnerable system is the web application itself: maybe not directly impacted? But the vulnerability is in the web app, and its exploitation leads to OS commands, so the web app's integrity might be compromised, but the impact is on the OS. In CVSS 3.1, scope changed, so the impacted component is the underlying OS (as subsequent system). For CVSS 4.0, we need to assign CIA to both components. The vulnerable component (the web app) might not suffer direct confidentiality/integrity/availability impact; it is used to execute code on a subsequent system. So VC/VI/VA could be N/N/N? But typical mapping: The attack results in execution of commands on the OS, so the vulnerable component (web app) might just be the vector, not directly impacted. But in CVSS 4.0, when scope changes, the vulnerable component gets some score from the subsequent. So I'll set VC:N, VI:N, VA:N (no direct impact on web app) and SC:H, SI:H, SA:H (full impact on OS). But that seems odd. Many assessments map S:C/C:H to SC:H in CVSS 4.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADIUS Policy API endpoints and gain unauthorized read access to sensitive policy details through direct API calls. The vulnerability affects ISE software across versions due to improper RBAC enforcement on API endpoints, enabling privilege escalation from read-only to unauthorized data disclosure. CVSS score is 4.3 with low attack complexity, but exploitation requires valid administrative credentials.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
We need to produce a JSON object with the specified fields. Let's begin by examining all provided data. CVE-2026-20132: Cisco Identity Services Engine (ISE) web management interface XSS vulnerabilities. CVSS 3.1: 4.8, vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. CWE-79. EPSS 0.03% (10th percentile). KEV: Not mentioned in input (no KEV data). Tags: Cisco, XSS. SSVC: Exploitation none, Automatable no, Technical Impact partial. Reported by Cisco. Affected versions list from EUVD: many versions of ISE software. References: Cisco advisory, NVD link. I need to create a synthesis: summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. All strings, no arrays/objects. Product name: "Cisco Identity Services Engine". That's specific. Summary: "Stored and reflected cross-site scripting in Cisco ISE web management interface allows authenticated admins with write privileges to inject script into pages, enabling session theft or phishing if user clicks a malicious link." But careful: summary must not start with "A vulnerability", must start with specific impact verb and product. So: "Cross-site scripting in Cisco Identity Services Engine 3.1–3.4 web interface enables authenticated administrative attackers to execute arbitrary JavaScript in other users' browsers, potentially stealing session tokens or sensitive data." Use all data: authenticated remote attacker with admin write privileges, stored/reflected XSS, user interaction required. EPSS 0.03% low, not actively exploited (no KEV, SSVC exploitation none). So mention that no known active exploitation, low EPSS. I'll craft: "Cross-site scripting in the web management interface of Cisco Identity Services Engine (ISE) versions 3.1.0 through 3.4.1 allows an authenticated attacker with administrative write privileges to inject arbitrary JavaScript via stored or reflected XSS. An attacker could exploit this by tricking another admin into clicking a crafted link, leading to session hijacking or data theft, though no active exploitation is known and the EPSS score is very low (0.03%)." That's good summary. Technical context: underlying technology: web-based management interface built for network access control. CWE-79 Improper Neutralization of Input During Web Page Generation (XSS). CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:* indicates all versions. Need to mention that user-supplied data is not sanitized when stored or reflected. Root cause: insufficient sanitization of user-supplied data before including it in web page output. This is classic XSS. The interface is used by admins to manage network access policies. Refer to CWE-79. I'll explain the technology: "Cisco ISE is a network access control and policy management platform. Its web-based management interface uses client-side JavaScript and server-rendered pages. The vulnerability arises from insufficient sanitization of user-supplied input that is stored in the web page (persistent XSS) or reflected in responses, falling under CWE-79. The affected software is identified by CPE 'cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*' covering all versions." Risk assessment: CVSS base 4.8, medium. Vector: AV:N (network exploitable) but requires high privileges (PR:H) – admin write privileges. UI:R (user interaction), scope changed (S:C) so impacts browser context of victim admin, not the ISE system itself. Confidentiality and integrity low (C:L/I:L) – can read some info and modify page content, no availability impact. EPSS 0.03% (10th percentile) – very low probability of exploitation in next 30 days. SSVC: exploitation none, automatable no, technical impact partial. POC? Not mentioned, so assume no public POC. No KEV. So overall risk: low real-world risk. High privileges needed, user interaction, only partial technical impact. Compare signals: CVSS medium, EPSS low, no active exploitation. So it's a low priority. Also need to check if there's any conflicting info: CVSS indicates network vector, which fits web interface. No conflict. So: "The CVSS score of 4.8 (Medium) reflects the requirement for high administrative privileges and user interaction, limiting the attack surface. The EPSS score of 0.03% indicates extremely low near-term exploitation probability, and CISA SSVC rates exploitation as none, automatable as no, with only partial technical impact. No public exploit or active exploitation has been observed. This vulnerability is low risk, primarily of concern if administrative credentials are compromised and social engineering succeeds." Affected products: list from EUVD. Write a paragraph: "Cisco Identity Services Engine Software versions 3.1.0, 3.1.0 p1 through p10, 3.2.0, 3.2.0 p1 through p7, 3.3.0, 3.3 Patch 1 through 4, 3.4.0, and 3.4 Patch 1 are affected. Detailed version information can be found in Cisco advisory cisco-sa-isexss-BS8ctE7U at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U." I'll include that URL. Remediation: Primary fix: upgrade to a patched version. The advisory reference likely has fix versions, but I don't have explicit fix version in input data. However, input says "Vendor-released patch: [exact version]" if known. In this case, we don't have exact version from the provided data. But I can state: "Cisco has released software updates that address these vulnerabilities. Administrators should refer to the Cisco advisory (cisco-sa-isexss-BS8ctE7U) for exact fixed releases and upgrade instructions. As a workaround, restrict administrative access to trusted networks and enforce strong authentication, and educate admins not to click untrusted links within the management interface." I'll add that no partial workaround like disabling features is specified. So: "Cisco has released patches; affected users should upgrade to a fixed version as detailed in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U. If immediate patching is not possible, restrict access to the management interface to trusted administrators only and implement content security policies, though such measures do not fully mitigate injected scripts already stored." Exploit scenario: Because requires high privileges, scenario: An attacker gains administrative access (perhaps through credential theft or phishing) to the ISE management console. The attacker then crafts a stored XSS payload in a configuration page (e.g., in a policy name or description) that executes when another admin views that page, stealing session cookies or performing actions. A reflected XSS could be delivered via a link sent to a different admin. POC not noted, so generic. "After compromising an admin account, an attacker could inject malicious JavaScript into an ISE configuration page (e.g., policy names). When another administrator views the affected page, the script executes in their browser session, potentially exfiltrating authentication tokens or manipulating ISE settings." I'll mention that this requires convincing a user to view the page/link. Exploitation conditions: CRITICAL FIELD. Specific prerequisites from description: "authenticated, remote attacker with administrative write privileges" and "convincing a user of the interface to click a specific link or view an affected web page". So conditions: The attacker must have valid administrative credentials with write access to the management interface. Additionally, the attack depends on user interaction: another administrative user must be lured into clicking a crafted link (reflected) or viewing a page where malicious content is stored (stored). There is no mention of non-default configuration beyond admin access. So I'll state: "Requires an authenticated administrative user with write privileges to the ISE web management interface to inject the XSS payload. Successful exploitation also requires tricking a victim administrator into clicking a malicious link or viewing a compromised page; the victim must be authenticated to the same management interface. The vulnerability does not require any additional non-default configuration, but the attacker's account must have write permissions." No generic phrases. Attack chain: Steps: Authenticated admin access (via stolen credentials) → inject malicious script via stored input or generate reflected link → deliver link/page to victim admin → victim interacts (clicks/view) → script executes in victim's browser context → exfiltrate session data or manipulate interface. Kill chain: Access (gain admin credentials) → Persist/Install (inject stored payload) → Delivery (social engineering) → Exploit (user clicks) → Execution (script runs) → Impact (data theft). Use short steps with arrows. So: "Compromise administrative credentials → Access ISE management interface → Inject stored XSS payload in configuration fields or craft reflected XSS URL → Deliver malicious link or lure victim admin to affected page → Victim clicks link or views page → Payload executes in victim’s browser session → Steal session tokens or sensitive data." That's 7 steps, but okay. I'll keep it concise: "Gain administrative access to ISE → Inject stored XSS payload → Trick another admin into viewing affected page → Script executes in victim’s browser → Capture session token or perform actions." Five steps with arrow separation. Confidence notes: What's confirmed: vendor (Cisco) reported and published advisory. NVD entry exists. CVSS vector provided by Cisco. SSVC from CISA. EUVD list of affected versions. What's inferred: We infer that all versions listed are vulnerable until patched; exact patch numbers not in our input. POC status: no public exploit identified, not in KEV. So: "Cisco advisory confirms the vulnerability and affected versions. NVD and EUVD list versions; no evidence of public exploit or active exploitation (no KEV, SSVC exploitation none). Exact fixed versions are referenced in the Cisco advisory but not independently verified here." Good. Prevalence: Cisco ISE is widely used in enterprise networks for network access control. It's a common enterprise product, but not as ubiquitous as Windows or Linux kernel. I'd say "medium" because it's a specific network security appliance deployed in many large organizations, but not everywhere. Prevalence basis: "widely deployed network access control platform in enterprise environments". So prevalence: medium, prevalence_basis: "widely deployed enterprise NAC appliance". But need to be careful: Cisco ISE is a major product in the NAC space, common in large enterprises, so "medium" might be appropriate. Could also be "high" for enterprise environments? I'll stick with medium, as not every company uses NAC. So: prevalence "medium", basis "widely deployed enterprise network access control platform". Assessed CVSS vector: My own independent vector. Given the description: attacker needs administrative write privileges (PR:H), user interaction required (UI:R), scope changed because the script executes in the victim's browser context (S:C), impacts confidentiality and integrity of that context (C:L/I:L) and no availability (A:N). Attack vector is network (AV:N) because web interface accessible remotely. Attack complexity low (AC:L) because XSS injection straightforward. So same as original: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. But I need to justify: "Requires high privileges and user interaction, with limited impact on confidentiality and integrity in victim’s browser." That's good. So output that vector. Assessed CVSS 4.0 vector: Need to map. CVSS 4.0 base: AV:N (Network), AC:L (Low), AT:N (Attack Requirements None, since no special conditions beyond attack), PR:H (High), UI:R (Required). VC: L (low confidentiality impact on vulnerable system? Actually, the vulnerable system is the ISE management interface but the impact is on the viewing user's browser context, which is considered a subsequent system. In CVSS 4.0, vulnerable system (VC/VI/VA) is the ISE itself? Wait, the description: script is executed in the context of the web-based management interface or allow attacker to access sensitive browser-based information. So the vulnerable system is the ISE web application, but the exploited vulnerability allows attacker to execute script in the victim's browser, which is a separate system. In CVSS 3.1, scope changed (S:C) indicates the vulnerable component (ISE web) and impacted component (browser context) are different. In CVSS 4.0, the base metrics use VC/VI/VA for the vulnerable system, and SC/SI/SA for subsequent system. For XSS, usually the vulnerable system's confidentiality and integrity
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to execute arbitrary operating system commands via crafted HTTP requests, resulting in full root access. The vulnerability, rated 9.9 (Critical), impacts multiple ISE versions; in single-node deployments, the affected device may become unavailable, causing denial of service. No active exploitation (KEV) or public exploit code has been identified, and the EPSS score of 0.21% indicates low likelihood of widespread attacks.
We need to produce a JSON with specific fields. The input: CVE-2026-20186, a Cisco ISE vulnerability. Description says: authenticated, remote attacker with Read Only Admin to execute arbitrary commands on OS. Insufficient input validation, crafted HTTP request, user-level access then elevate to root. In single-node deployments, DoS possible. CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-77: Command Injection. EPSS 0.23% (46th percentile). KEV status not in input? Input does not mention KEV. Tags: Denial Of Service, Cisco, Command Injection, Cisco Identity Services Engine Software. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD lists many affected versions. CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*. References: Cisco advisory, NVD, vuldb. No mention of POC or KEV in the multi-source intelligence. SSVC says exploitation: none and automatable: no (so no active exploitation, not automatable). So the exploitation status is "no public exploit identified at time of analysis". No KEV listing. We must synthesize all data. product_name: "Cisco Identity Services Engine Software" but maybe just "Cisco ISE"? The description says "Cisco Identity Services Engine (ISE)". So "Cisco Identity Services Engine" but too long? "Cisco ISE" might be recognized. "Cisco Identity Services Engine" is primary. I'll use "Cisco ISE" as product_name (1-3 words). "Cisco ISE" is okay (2 words). I'll use "Cisco ISE". But I can also say "Cisco Identity Services Engine Software". Three words: "Cisco ISE Software"? "Cisco ISE" is clear. Summary: Not copy description. Start with impact verb. Example: "Command injection in Cisco ISE allows authenticated remote attacker with Read-Only Admin privileges to achieve OS command execution and privilege escalation to root, leading to total compromise and potential denial of service." Use EPSS, KEV? No KEV, EPSS low (0.23%), so not actively exploited. So: "A command injection vulnerability in Cisco Identity Services Engine (ISE) allows an authenticated attacker with Read-Only Admin privileges to execute arbitrary commands on the underlying OS via crafted HTTP requests, potentially escalating to root. Successful exploitation can lead to full device compromise and, in single-node deployments, a denial-of-service condition. Cisco has released a patch." No active exploitation. I'll incorporate EPSS: low exploitation probability. So: "Command injection in Cisco Identity Services Engine (ISE) allows an authenticated remote attacker with Read-Only Admin credentials to execute arbitrary commands on the underlying operating system via crafted HTTP requests, leading to full compromise with root access and, in single-node deployments, denial of service. Although the CVSS score is 9.9 (critical), EPSS indicates low exploitation probability (0.23%) and no active exploitation has been observed." That's good. technical_context: Explain underlying tech, CWE-77 (Command Injection). Cisco ISE is a network access control policy engine. The vulnerability is command injection due to insufficient input validation. CPE indicates software versions. Reference CWE-77. So: "Cisco Identity Services Engine is a security policy management platform that controls network access. This vulnerability is a command injection (CWE-77) arising from insufficient validation of user input processed by the ISE web interface. The attacker can inject arbitrary commands that are executed on the underlying Linux-based operating system. Affected software versions include multiple patches of Cisco ISE 3.1, 3.2, 3.3, and 3.4 as listed in ENISA EUVD." I'll mention CPE. risk_assessment: Use CVSS vector, EPSS, SSVC, KEV (none), POC (none). Compare signals: CVSS 9.9 Critical, but PR:L (read-only admin), so authentication is needed; attack complexity low, scope changed, so high impact. EPSS 0.23% is low, percentile 46% (so below median). SSVC: exploitation none, automatable no, so not currently being exploited, and not easily automated. So real-world risk is moderate: requires authenticated access with at least Read-Only Admin, which is not trivial, but if compromised, full control. So: "CVSS 9.9 indicates a critical severity due to network vector, low attack complexity, low privileges, and scope change leading to high impacts. However, exploitation requires an attacker to have Read-Only Admin privileges (PR:L), which limits the pool of potential attackers to those who can obtain such credentials. EPSS score of 0.23% (46th percentile) suggests low likelihood of widespread exploitation in the wild. SSVC analysis shows no current exploitation and not automatable, further reducing the immediate urgency. Although the impact is total compromise, the need for authenticated access to the management interface lowers the real-world risk, though organizations with exposed admin interfaces or weak credential hygiene face higher risk." I need to note conflicting or missing data: no active exploitation, patch available. No conflicting signals. affected_products: List versions from EUVD enumeration. "Cisco Identity Services Engine Software versions 3.1.0 through 3.4 Patch 3 are affected. Specifically, multiple patch levels of 3.1, 3.2, 3.3, and 3.4 as listed by ENISA EUVD are vulnerable. The Cisco security advisory (cisco-sa-ise-rce-4fverepv) provides full details and fixed releases." I'll reference advisory URL. remediation: "Cisco has released software updates to address this vulnerability; upgrades to the latest patched versions are recommended. Refer to the Cisco advisory cisco-sa-ise-rce-4fverepv for specific fixed versions (e.g., 3.1.0 Patch 10 or later, 3.2.0 Patch 7 or later, 3.3 Patch 7 or later, 3.4 Patch 3 or later). As a workaround, restrict network access to the ISE management interface to trusted IPs only, and enforce strong credential policies to prevent unauthorized read-only admin access. However, these are compensating controls; applying the vendor patch is the definitive solution." Since the vulnerability requires authenticated access, restricting admin interface access can help. exploit_scenario: "An attacker who has obtained Read-Only Admin credentials (e.g., through phishing or credential reuse) could leverage the command injection via crafted HTTP request to achieve arbitrary command execution with user-level OS access, then elevate to root to take full control of the ISE node." So 2-3 sentences. exploitation_conditions: Extract concrete prerequisites: Must have at least Read-Only Admin credentials (authenticated). Attack vector is network, but exploitation requires sending crafted HTTP request to the management interface. So specific condition: "The attacker must have valid credentials with at least Read-Only Admin privileges on the Cisco ISE device’s management interface. No configuration changes are required; the vulnerability exists in the input validation of a web application component. Exploitation is limited by the need for authenticated access to the administrative web interface, making it inaccessible to unauthenticated external attackers unless credentials are obtained." Also mention that single-node deployments extra DoS condition? Not a condition for exploitation, but impact. So: "Exploitation requires valid credentials with Read-Only Admin role on the ISE management web interface, which is typically restricted to network administrators. There is no indication that default configurations or public-facing deployments without authentication are vulnerable; however, if the admin interface is exposed to the internet or accessible without multi-factor authentication, the attack surface increases." Avoid generic phrases. So: "Requires authenticated access with at least Read-Only Admin credentials on the Cisco ISE administrative HTTP interface. No other special conditions—the flaw is present in default configurations as long as the attacker can interact with the web application." That's specific. attack_chain: Use phases. Steps: Obtain Read-Only Admin credentials (recon/delivery) → Send crafted HTTP request to ISE web interface → Exploit command injection vulnerability → Execute arbitrary commands as user-level OS account → Elevate privileges to root → Achieve full compromise or denial of service. Short steps: "Obtain Read-Only Admin credentials" → "Send crafted HTTP request to ISE management web interface" → "Trigger command injection via insufficient input validation" → "Execute commands as unprivileged OS user" → "Elevate privileges to root" → "Full node compromise or single-node DoS". That's 6 steps. confidence_notes: "Cisco has confirmed the vulnerability and released a security advisory with patches. Affected versions are listed by ENISA. No active exploitation has been reported; CISA KEV does not include this CVE, and SSVC indicates exploitation: none and automatable: no. The EPSS score is 0.23%, indicating low likelihood of exploitation. The CVSS vector and description are consistent. Missing: proof of concept code is not publicly available at this time." But we don't know about POC; can say "No public exploit code has been identified at time of analysis." So: "Cisco advisory confirms the vulnerability and patch availability. No active exploitation has been observed (not in CISA KEV, SSVC exploitation: none). EPSS low. Affected versions are confirmed via EUVD and vendor advisory. No public proof-of-concept code has been released. The CVSS vector aligns with the description." That's fine. prevalence: Cisco ISE is a widely used network access control product in enterprise environments. So prevalence: "high". Justification: "Cisco ISE is a widely deployed enterprise access control solution." So prevalence_basis: "widely deployed enterprise access control solution". Good. assessed_cvss_vector: My own independent CVSS 3.1 vector. I need to adjust? I can use: AV:N (network, HTTP request), AC:L (no special complexity, just crafted request), PR:L (requires read-only admin), UI:N (no user interaction beyond the attack request), S:C (scope change, OS commands executed on underlying OS from the application component), C:H/I:H/A:H (full compromise). So replicating the given vector. I'll output "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H". That's identical. I need to justify: "Requires authenticated access (PR:L) but no user interaction and no complexity; scope change leads to full impact." So rationale: "Network vector with low complexity, low privileges (Read-Only Admin), and scope change results in total system compromise." That's good. assessed_cvss40_vector: Convert to CVSS 4.0 base vector. For base, we need AV, AC, AT, PR, UI, VC, VI, VA, SC, SI, SA. Attack Vector: Network (N). Attack Complexity: Low (L). Attack Requirements: None (N) — since no specific requirement, so AT:N. Privileges Required: Low (L). User Interaction: None (N). Vulnerable System Confidentiality: High (H) (commands executed on OS give access to data). Integrity: High (H). Availability: High (H). Subsequent System: None (N) for all, because it's the same system? Actually scope change from application to OS, but in CVSS 4.0, the Vulnerable System (the application web interface) is the first. The impact on the OS is considered a subsequent system? The vulnerable component is the web application, the subsequent system is the OS. So SC, SI, SA should reflect impact on the OS: High because full compromise. So "SC:H/SI:H/SA:H". But the CVSS 4.0 base vector uses VC/VI/VA for the vulnerable component's CIA, and SC/SI/SA for the subsequent system. So the vulnerable system is the web application itself: maybe not directly impacted? But the vulnerability is in the web app, and its exploitation leads to OS commands, so the web app's integrity might be compromised, but the impact is on the OS. In CVSS 3.1, scope changed, so the impacted component is the underlying OS (as subsequent system). For CVSS 4.0, we need to assign CIA to both components. The vulnerable component (the web app) might not suffer direct confidentiality/integrity/availability impact; it is used to execute code on a subsequent system. So VC/VI/VA could be N/N/N? But typical mapping: The attack results in execution of commands on the OS, so the vulnerable component (web app) might just be the vector, not directly impacted. But in CVSS 4.0, when scope changes, the vulnerable component gets some score from the subsequent. So I'll set VC:N, VI:N, VA:N (no direct impact on web app) and SC:H, SI:H, SA:H (full impact on OS). But that seems odd. Many assessments map S:C/C:H to SC:H in CVSS 4.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADIUS Policy API endpoints and gain unauthorized read access to sensitive policy details through direct API calls. The vulnerability affects ISE software across versions due to improper RBAC enforcement on API endpoints, enabling privilege escalation from read-only to unauthorized data disclosure. CVSS score is 4.3 with low attack complexity, but exploitation requires valid administrative credentials.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
We need to produce a JSON object with the specified fields. Let's begin by examining all provided data. CVE-2026-20132: Cisco Identity Services Engine (ISE) web management interface XSS vulnerabilities. CVSS 3.1: 4.8, vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. CWE-79. EPSS 0.03% (10th percentile). KEV: Not mentioned in input (no KEV data). Tags: Cisco, XSS. SSVC: Exploitation none, Automatable no, Technical Impact partial. Reported by Cisco. Affected versions list from EUVD: many versions of ISE software. References: Cisco advisory, NVD link. I need to create a synthesis: summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. All strings, no arrays/objects. Product name: "Cisco Identity Services Engine". That's specific. Summary: "Stored and reflected cross-site scripting in Cisco ISE web management interface allows authenticated admins with write privileges to inject script into pages, enabling session theft or phishing if user clicks a malicious link." But careful: summary must not start with "A vulnerability", must start with specific impact verb and product. So: "Cross-site scripting in Cisco Identity Services Engine 3.1–3.4 web interface enables authenticated administrative attackers to execute arbitrary JavaScript in other users' browsers, potentially stealing session tokens or sensitive data." Use all data: authenticated remote attacker with admin write privileges, stored/reflected XSS, user interaction required. EPSS 0.03% low, not actively exploited (no KEV, SSVC exploitation none). So mention that no known active exploitation, low EPSS. I'll craft: "Cross-site scripting in the web management interface of Cisco Identity Services Engine (ISE) versions 3.1.0 through 3.4.1 allows an authenticated attacker with administrative write privileges to inject arbitrary JavaScript via stored or reflected XSS. An attacker could exploit this by tricking another admin into clicking a crafted link, leading to session hijacking or data theft, though no active exploitation is known and the EPSS score is very low (0.03%)." That's good summary. Technical context: underlying technology: web-based management interface built for network access control. CWE-79 Improper Neutralization of Input During Web Page Generation (XSS). CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:* indicates all versions. Need to mention that user-supplied data is not sanitized when stored or reflected. Root cause: insufficient sanitization of user-supplied data before including it in web page output. This is classic XSS. The interface is used by admins to manage network access policies. Refer to CWE-79. I'll explain the technology: "Cisco ISE is a network access control and policy management platform. Its web-based management interface uses client-side JavaScript and server-rendered pages. The vulnerability arises from insufficient sanitization of user-supplied input that is stored in the web page (persistent XSS) or reflected in responses, falling under CWE-79. The affected software is identified by CPE 'cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*' covering all versions." Risk assessment: CVSS base 4.8, medium. Vector: AV:N (network exploitable) but requires high privileges (PR:H) – admin write privileges. UI:R (user interaction), scope changed (S:C) so impacts browser context of victim admin, not the ISE system itself. Confidentiality and integrity low (C:L/I:L) – can read some info and modify page content, no availability impact. EPSS 0.03% (10th percentile) – very low probability of exploitation in next 30 days. SSVC: exploitation none, automatable no, technical impact partial. POC? Not mentioned, so assume no public POC. No KEV. So overall risk: low real-world risk. High privileges needed, user interaction, only partial technical impact. Compare signals: CVSS medium, EPSS low, no active exploitation. So it's a low priority. Also need to check if there's any conflicting info: CVSS indicates network vector, which fits web interface. No conflict. So: "The CVSS score of 4.8 (Medium) reflects the requirement for high administrative privileges and user interaction, limiting the attack surface. The EPSS score of 0.03% indicates extremely low near-term exploitation probability, and CISA SSVC rates exploitation as none, automatable as no, with only partial technical impact. No public exploit or active exploitation has been observed. This vulnerability is low risk, primarily of concern if administrative credentials are compromised and social engineering succeeds." Affected products: list from EUVD. Write a paragraph: "Cisco Identity Services Engine Software versions 3.1.0, 3.1.0 p1 through p10, 3.2.0, 3.2.0 p1 through p7, 3.3.0, 3.3 Patch 1 through 4, 3.4.0, and 3.4 Patch 1 are affected. Detailed version information can be found in Cisco advisory cisco-sa-isexss-BS8ctE7U at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U." I'll include that URL. Remediation: Primary fix: upgrade to a patched version. The advisory reference likely has fix versions, but I don't have explicit fix version in input data. However, input says "Vendor-released patch: [exact version]" if known. In this case, we don't have exact version from the provided data. But I can state: "Cisco has released software updates that address these vulnerabilities. Administrators should refer to the Cisco advisory (cisco-sa-isexss-BS8ctE7U) for exact fixed releases and upgrade instructions. As a workaround, restrict administrative access to trusted networks and enforce strong authentication, and educate admins not to click untrusted links within the management interface." I'll add that no partial workaround like disabling features is specified. So: "Cisco has released patches; affected users should upgrade to a fixed version as detailed in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U. If immediate patching is not possible, restrict access to the management interface to trusted administrators only and implement content security policies, though such measures do not fully mitigate injected scripts already stored." Exploit scenario: Because requires high privileges, scenario: An attacker gains administrative access (perhaps through credential theft or phishing) to the ISE management console. The attacker then crafts a stored XSS payload in a configuration page (e.g., in a policy name or description) that executes when another admin views that page, stealing session cookies or performing actions. A reflected XSS could be delivered via a link sent to a different admin. POC not noted, so generic. "After compromising an admin account, an attacker could inject malicious JavaScript into an ISE configuration page (e.g., policy names). When another administrator views the affected page, the script executes in their browser session, potentially exfiltrating authentication tokens or manipulating ISE settings." I'll mention that this requires convincing a user to view the page/link. Exploitation conditions: CRITICAL FIELD. Specific prerequisites from description: "authenticated, remote attacker with administrative write privileges" and "convincing a user of the interface to click a specific link or view an affected web page". So conditions: The attacker must have valid administrative credentials with write access to the management interface. Additionally, the attack depends on user interaction: another administrative user must be lured into clicking a crafted link (reflected) or viewing a page where malicious content is stored (stored). There is no mention of non-default configuration beyond admin access. So I'll state: "Requires an authenticated administrative user with write privileges to the ISE web management interface to inject the XSS payload. Successful exploitation also requires tricking a victim administrator into clicking a malicious link or viewing a compromised page; the victim must be authenticated to the same management interface. The vulnerability does not require any additional non-default configuration, but the attacker's account must have write permissions." No generic phrases. Attack chain: Steps: Authenticated admin access (via stolen credentials) → inject malicious script via stored input or generate reflected link → deliver link/page to victim admin → victim interacts (clicks/view) → script executes in victim's browser context → exfiltrate session data or manipulate interface. Kill chain: Access (gain admin credentials) → Persist/Install (inject stored payload) → Delivery (social engineering) → Exploit (user clicks) → Execution (script runs) → Impact (data theft). Use short steps with arrows. So: "Compromise administrative credentials → Access ISE management interface → Inject stored XSS payload in configuration fields or craft reflected XSS URL → Deliver malicious link or lure victim admin to affected page → Victim clicks link or views page → Payload executes in victim’s browser session → Steal session tokens or sensitive data." That's 7 steps, but okay. I'll keep it concise: "Gain administrative access to ISE → Inject stored XSS payload → Trick another admin into viewing affected page → Script executes in victim’s browser → Capture session token or perform actions." Five steps with arrow separation. Confidence notes: What's confirmed: vendor (Cisco) reported and published advisory. NVD entry exists. CVSS vector provided by Cisco. SSVC from CISA. EUVD list of affected versions. What's inferred: We infer that all versions listed are vulnerable until patched; exact patch numbers not in our input. POC status: no public exploit identified, not in KEV. So: "Cisco advisory confirms the vulnerability and affected versions. NVD and EUVD list versions; no evidence of public exploit or active exploitation (no KEV, SSVC exploitation none). Exact fixed versions are referenced in the Cisco advisory but not independently verified here." Good. Prevalence: Cisco ISE is widely used in enterprise networks for network access control. It's a common enterprise product, but not as ubiquitous as Windows or Linux kernel. I'd say "medium" because it's a specific network security appliance deployed in many large organizations, but not everywhere. Prevalence basis: "widely deployed network access control platform in enterprise environments". So prevalence: medium, prevalence_basis: "widely deployed enterprise NAC appliance". But need to be careful: Cisco ISE is a major product in the NAC space, common in large enterprises, so "medium" might be appropriate. Could also be "high" for enterprise environments? I'll stick with medium, as not every company uses NAC. So: prevalence "medium", basis "widely deployed enterprise network access control platform". Assessed CVSS vector: My own independent vector. Given the description: attacker needs administrative write privileges (PR:H), user interaction required (UI:R), scope changed because the script executes in the victim's browser context (S:C), impacts confidentiality and integrity of that context (C:L/I:L) and no availability (A:N). Attack vector is network (AV:N) because web interface accessible remotely. Attack complexity low (AC:L) because XSS injection straightforward. So same as original: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. But I need to justify: "Requires high privileges and user interaction, with limited impact on confidentiality and integrity in victim’s browser." That's good. So output that vector. Assessed CVSS 4.0 vector: Need to map. CVSS 4.0 base: AV:N (Network), AC:L (Low), AT:N (Attack Requirements None, since no special conditions beyond attack), PR:H (High), UI:R (Required). VC: L (low confidentiality impact on vulnerable system? Actually, the vulnerable system is the ISE management interface but the impact is on the viewing user's browser context, which is considered a subsequent system. In CVSS 4.0, vulnerable system (VC/VI/VA) is the ISE itself? Wait, the description: script is executed in the context of the web-based management interface or allow attacker to access sensitive browser-based information. So the vulnerable system is the ISE web application, but the exploited vulnerability allows attacker to execute script in the victim's browser, which is a separate system. In CVSS 3.1, scope changed (S:C) indicates the vulnerable component (ISE web) and impacted component (browser context) are different. In CVSS 4.0, the base metrics use VC/VI/VA for the vulnerable system, and SC/SI/SA for subsequent system. For XSS, usually the vulnerable system's confidentiality and integrity