Cisco Integrated Management Controller Cross-Site Scripting Vulnerabilities
🔗 CVE IDs covered (5)
📋 Description
Multiple vulnerabilities in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVE-2026-20087 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) CVE-2026-20085 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) CVE-2026-20088 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) CVE-2026-20090 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) CVE-2026-20089 — Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 3.1 4.8, CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
🎯 Affected products242
- Cisco Enterprise NFV Infrastructure Software
- Cisco Unified Computing System (Standalone)
- Cisco Unified Computing System E-Series Software (UCSE)
- Cisco Enterprise NFV Infrastructure Software 3.10.1
- Cisco Enterprise NFV Infrastructure Software 3.10.2
- Cisco Enterprise NFV Infrastructure Software 3.10.3
- Cisco Enterprise NFV Infrastructure Software 3.11.1
- Cisco Enterprise NFV Infrastructure Software 3.11.2
- Cisco Enterprise NFV Infrastructure Software 3.11.3
- Cisco Enterprise NFV Infrastructure Software 3.12.1
- Cisco Enterprise NFV Infrastructure Software 3.12.2
- Cisco Enterprise NFV Infrastructure Software 3.12.3
- Cisco Enterprise NFV Infrastructure Software 3.3.1
- Cisco Enterprise NFV Infrastructure Software 3.4.1
- Cisco Enterprise NFV Infrastructure Software 3.5.1
- Cisco Enterprise NFV Infrastructure Software 3.5.2
- Cisco Enterprise NFV Infrastructure Software 3.6.1
- Cisco Enterprise NFV Infrastructure Software 3.6.2
- Cisco Enterprise NFV Infrastructure Software 3.6.3
- Cisco Enterprise NFV Infrastructure Software 3.7.1
- Cisco Enterprise NFV Infrastructure Software 3.8.1
- Cisco Enterprise NFV Infrastructure Software 3.9.1
- Cisco Enterprise NFV Infrastructure Software 3.9.2
- Cisco Enterprise NFV Infrastructure Software 4.1.1
- Cisco Enterprise NFV Infrastructure Software 4.1.2
- Cisco Enterprise NFV Infrastructure Software 4.10.1
- Cisco Enterprise NFV Infrastructure Software 4.11.1
- Cisco Enterprise NFV Infrastructure Software 4.12.1
- Cisco Enterprise NFV Infrastructure Software 4.12.2
- Cisco Enterprise NFV Infrastructure Software 4.12.3
- +212 more not shown
✅ Remediation
Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address these vulnerabilities.
🔗 References (29)
- advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB
- csafhttps://www.cisco.com/.well-known/csaf/2026/cisco-sa-cimc-xss-a2tkgvab.json
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07159
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07240
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07501
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07585
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07591
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07597
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07154
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07239
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07351
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07589
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCws07596
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60930
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60933
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60939
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60943
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60944
- externalhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCwr60948
- externalhttps://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/c/sw/lomug/4-2/b_cisco-host-upgrade-utility-user-guide-4-2/m_upgrading-the-firmware.html
- externalhttps://www.cisco.com/c/dam/en/us/td/docs/security/Telemetry_Broker/Release-Notes/m6-tb2300-ctb-firmware-6_0-2_260044_iso_DV_1_0.pdf
- externalhttps://software.cisco.com/download/home/286331621/type/286331613/release/HUU%204.3.6
- externalhttps://www.cisco.com/c/en/us/support/docs/security/secure-endpoint-private-cloud/222008-cisco-secure-endpoint-private-cloud-firm.html
- externalhttps://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/hotfix/threat-defense-release-notes-hotfix.html#Cisco_Reference.dita_e5a104de-579f-48b7-adb6-0a72dc5183b7
- externalhttps://www.cisco.com/c/en/us/td/docs/security/secure-malware-analytics/admin-guide/v2-19/secure-malware-analytics-guide/m_oob-update-firmware.html
- externalhttps://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cimc_bios/M5_CIMC_FIRMWARE_4_3_2_260007_readme_DV_1_0.pdf
- externalhttps://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cimc_bios/M6_CIMC_FIRMWARE_6_0_2_260044_readme_DV_1_0.pdf
- externalhttps://www.cisco.com/c/en/us/td/docs/security/ise/sns3600hig/sns-36xx-firmware-4-x-xx_upgrade_guide.html#Cisco_Concept.dita_3e2c957e-62e6-4b2d-9f76-96ad121f29e1
- externalhttps://www.cisco.com/c/en/us/td/docs/security/ise/sns3700hig/sns-37xx-firmware-4-x-xx_upgrade_guide.html#r_overview