CVE-2026-20088
Stored XSS in Cisco IMC Web Interface Allows Remote Script Execution
Publication date: 2026-04-01
Last updated on: 2026-04-01
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | imc | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the web-based management interface of Cisco IMC. It allows an authenticated remote attacker who already has administrative privileges to perform a stored Cross-Site Scripting (XSS) attack against users of the interface.
The root cause is insufficient validation of user input. An attacker can exploit this by convincing a user to click on a specially crafted link, which then executes arbitrary script code in the user's browser or accesses sensitive browser-based information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted users with administrative privileges access the Cisco IMC web-based management interface.
Avoid clicking on untrusted or suspicious links within the interface to prevent exploitation via stored XSS.
Monitor for updates or patches from Cisco addressing this vulnerability and apply them promptly once available.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the browser of a targeted user. This can lead to unauthorized access to sensitive information available in the browser context.
Since the attacker needs administrative privileges and user interaction (clicking a crafted link), the risk involves potential compromise of user sessions, theft of sensitive data, or manipulation of the interface through malicious scripts.