CVE-2026-20089
Stored XSS in Cisco IMC Web Interface Enables Remote Script Execution
Publication date: 2026-04-01
Last updated on: 2026-04-01
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | imc | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the browser of a targeted user. This can lead to unauthorized access to sensitive information available in the browser context or manipulation of the web interface as the victim user.
Because the attacker needs administrative privileges and user interaction (clicking a crafted link), the risk is somewhat limited but still significant in environments where trusted users might be targeted.
Can you explain this vulnerability to me?
This vulnerability exists in the web-based management interface of Cisco IMC. It allows an authenticated remote attacker who already has administrative privileges to perform a stored Cross-Site Scripting (XSS) attack against another user of the interface.
The root cause is insufficient validation of user input. An attacker can exploit this by convincing a user to click on a specially crafted link, which then executes arbitrary script code in the victim's browser or accesses sensitive browser-based information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authenticated attacker with administrative privileges to conduct a stored cross-site scripting (XSS) attack, potentially leading to the execution of arbitrary script code in the browser of a targeted user or access to sensitive browser-based information.
Such unauthorized access to sensitive information and the potential compromise of user sessions could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and attacks.
However, the provided information does not explicitly detail the direct impact on compliance with these standards.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted users have administrative privileges to the Cisco IMC web-based management interface.
Educate users to avoid clicking on untrusted or suspicious links while using the interface.
Monitor for updates or patches from Cisco addressing this stored XSS vulnerability and apply them promptly once available.