CiscoCVE-2026-20198
Cisco Enterprise NFV Infrastructure Software: cross-site scripting
Medium4.8CVE-2026-20198 · Published Aug 5, 2026 · updated Aug 6, 2026
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Cisco Enterprise NFV Infrastructure Software Product | <= 4.1.1 | No fix yet |
| <= 3.9.1 | No fix yet | |
| <= 3.5.2 | No fix yet | |
| <= 3.12.2 | No fix yet | |
| Cisco Unified Computing System (Standalone) Product | <= 4.0(2g) | No fix yet |
| <= 3.1(2i) | No fix yet | |
| <= 3.1(1d) | No fix yet | |
| <= 4.0(4i) | No fix yet | |
| Cisco Unified Computing System E-Series Software (UCSE) Product | <= 3.2.7 | No fix yet |
| <= 3.2.6 | No fix yet | |
| <= 3.2.4 | No fix yet | |
| <= 3.2.10 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79
More Cisco advisories
All Cisco| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 5 | Cisco Catalyst SD-WAN: cleartext secrets | High8.8 | No fix yet |
| Aug 5 | Cisco Catalyst SD-WAN: improper quantity validation | High7.7 | No fix yet |
| Aug 5 | Cisco IOS XE Software: denial of service | Medium4.3 | No fix yet |
| Aug 5 | Cisco Catalyst SD-WAN: link following | Critical9.1 | No fix yet |
| Aug 5 | Cisco IOS XE Software: denial of service | Medium6.3 | No fix yet |
| Aug 5 | Cisco IOS XE Software: denial of service | High8.6 | No fix yet |