CVE-2026-20091
Received Received - Intake
Stored XSS in Cisco FXOS and UCS Manager Web Interface

Publication date: 2026-02-25

Last updated on: 2026-02-25

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious data into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials for a user account with the role of Administrator or AAA Administrator. 
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-25
Last Modified
2026-02-25
Generated
2026-06-16
AI Q&A
2026-02-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-20091
EUVD
EUVD-2026-8670
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
cisco fxos_software *
cisco ucs_manager_software *
cisco ucs_manager_software From 4.3(6a) (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-20091 is a medium-severity stored cross-site scripting (XSS) vulnerability affecting the web-based management interfaces of Cisco FXOS Software and Cisco UCS Manager Software.

The vulnerability occurs because the interface does not properly validate user-supplied input, allowing an authenticated remote attacker with Administrator or AAA Administrator credentials to inject malicious scripts into specific pages of the interface.

If successfully exploited, the attacker can execute arbitrary script code within the context of the affected interface, potentially exposing sensitive browser-based information.

Impact Analysis

This vulnerability can allow an authenticated attacker with high-level privileges to execute arbitrary scripts in the web management interface, which may lead to unauthorized access to sensitive information stored or displayed in the browser.

Such an attack could compromise the confidentiality and integrity of data accessible through the interface, potentially leading to further exploitation or unauthorized actions within the management system.

However, exploitation requires valid Administrator or AAA Administrator credentials and user interaction.

Compliance Impact

I don't know

Detection Guidance

This vulnerability affects specific Cisco products running vulnerable FXOS or UCS Manager software releases. Cisco provides the Cisco Software Checker tool to help customers identify affected software versions and the earliest fixed releases.

Since the vulnerability requires valid Administrator or AAA Administrator credentials and involves stored cross-site scripting in the web-based management interface, detection involves verifying the software version and monitoring for suspicious script injections in the interface.

No specific commands are provided in the available resources for detecting this vulnerability on your network or system.

Mitigation Strategies

There are no workarounds available to mitigate this vulnerability.

Cisco strongly recommends upgrading to fixed software releases to address this vulnerability.

  • For UCS Fabric Interconnects (6300, 6400, 6500, 9108 100G), upgrade to releases 4.3(6a) and later.
  • For other affected devices, verify compatibility and upgrade to the fixed software versions as detailed in Cisco’s advisory.

Contact Cisco TAC for assistance if needed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart