cisco-sa-cimc-xss-7EhBFxBpMediumCVSS 4.8

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

Published
August 5, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-20198 →

📋 Description

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVE-2026-20198 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

🎯 Affected products249

  • Cisco Enterprise NFV Infrastructure Software
  • Cisco Unified Computing System (Standalone)
  • Cisco Unified Computing System E-Series Software (UCSE)
  • Cisco Enterprise NFV Infrastructure Software 3.10.1
  • Cisco Enterprise NFV Infrastructure Software 3.10.2
  • Cisco Enterprise NFV Infrastructure Software 3.10.3
  • Cisco Enterprise NFV Infrastructure Software 3.11.1
  • Cisco Enterprise NFV Infrastructure Software 3.11.2
  • Cisco Enterprise NFV Infrastructure Software 3.11.3
  • Cisco Enterprise NFV Infrastructure Software 3.12.1
  • Cisco Enterprise NFV Infrastructure Software 3.12.2
  • Cisco Enterprise NFV Infrastructure Software 3.12.3
  • Cisco Enterprise NFV Infrastructure Software 3.3.1
  • Cisco Enterprise NFV Infrastructure Software 3.4.1
  • Cisco Enterprise NFV Infrastructure Software 3.5.1
  • Cisco Enterprise NFV Infrastructure Software 3.5.2
  • Cisco Enterprise NFV Infrastructure Software 3.6.1
  • Cisco Enterprise NFV Infrastructure Software 3.6.2
  • Cisco Enterprise NFV Infrastructure Software 3.6.3
  • Cisco Enterprise NFV Infrastructure Software 3.7.1
  • Cisco Enterprise NFV Infrastructure Software 3.8.1
  • Cisco Enterprise NFV Infrastructure Software 3.9.1
  • Cisco Enterprise NFV Infrastructure Software 3.9.2
  • Cisco Enterprise NFV Infrastructure Software 4.1.1
  • Cisco Enterprise NFV Infrastructure Software 4.1.2
  • Cisco Enterprise NFV Infrastructure Software 4.10.1
  • Cisco Enterprise NFV Infrastructure Software 4.11.1
  • Cisco Enterprise NFV Infrastructure Software 4.12.1
  • Cisco Enterprise NFV Infrastructure Software 4.12.2
  • Cisco Enterprise NFV Infrastructure Software 4.12.3
  • +219 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability.

🔗 References (13)