nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-20198 CVE-2026-20198
MEDIUM
Cisco Integrated Management Controller Cross-Site Scripting Vulnerability
Record summary
CVE-2026-20198 has a selected CVSS score of 4.8 (medium).
Description
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Cisco Enterprise NFV Infrastructure SoftwareBrowse Cisco / Cisco Enterprise NFV Infrastructure SoftwareDefault status: unknown | CVE List | 4.1.1 | affected |
| 3.9.1 | affected | ||
| 3.5.2 | affected | ||
| 3.12.2 | affected | ||
| 3.6.2 | affected | ||
| 3.9.2 | affected | ||
| 3.11.3 | affected | ||
| 3.11.1 | affected | ||
| 3.5.1 | affected | ||
| 3.3.1 | affected | ||
| 3.10.2 | affected | ||
| 3.12.1b | affected | ||
| Showing 12 of 72 version ranges | |||
Cisco Unified Computing System (Standalone)Browse Cisco / Cisco Unified Computing System (Standalone)Default status: unknown | CVE List | 4.0(2g) | affected |
| 3.1(2i) | affected | ||
| 3.1(1d) | affected | ||
| 4.0(4i) | affected | ||
| 4.1(1c) | affected | ||
| 4.0(2c) | affected | ||
| 4.0(1e) | affected | ||
| 4.0(2h) | affected | ||
| 4.0(4h) | affected | ||
| 4.0(1h) | affected | ||
| 4.0(2l) | affected | ||
| 3.1(3g) | affected | ||
| Showing 12 of 156 version ranges | |||
Cisco Unified Computing System E-Series Software (UCSE)Browse Cisco / Cisco Unified Computing System E-Series Software (UCSE)Default status: unknown | CVE List | 3.2.7 | affected |
| 3.2.6 | affected | ||
| 3.2.4 | affected | ||
| 3.2.10 | affected | ||
| 3.2.2 | affected | ||
| 3.2.3 | affected | ||
| 3.2.1 | affected | ||
| 3.2.11.1 | affected | ||
| 3.2.8 | affected | ||
| 3.1.1 | affected | ||
| 3.1.2 | affected | ||
| 3.1.4 | affected | ||
| Showing 12 of 31 version ranges | |||
References
2cisco-sa-cimc-xss-7EhBFxBp
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp