Product:
Cisco Identity Services Engine
Summary
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-20076 |
Exploitation
To exploit this vulnerability, an attacker must have valid administrative credentials. Once authenticated, the attacker can inject malicious code into specific pages of the web-based management interface. This code can then be executed in the context of the affected interface, potentially allowing the attacker to access sensitive browser-based information.
Affected Products
- Cisco Identity Services Engine: Vulnerable due to insufficient input validation in the web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper input validation and sanitization practices are in place. Additionally, restricting access to the web-based management interface to trusted users and networks can help reduce the risk of exploitation.