Product:
Cisco FXOS Software and Cisco UCS Manager Software
Summary
A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by injecting malicious data into specific pages of the interface.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-20091 |
Exploitation
To exploit this vulnerability, the attacker must have valid credentials for a user account with the role of Administrator or AAA Administrator. Once authenticated, the attacker can inject malicious scripts into the web interface, which could then be executed in the context of the affected interface, potentially allowing access to sensitive information.
Affected Products
- Cisco FXOS Software: Vulnerable due to insufficient input validation in the web management interface.
- Cisco UCS Manager Software: Also affected by the same vulnerability allowing for stored XSS attacks.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure they are using the latest version of the affected software and apply any available security patches. Additionally, users should limit access to the web-based management interface to trusted networks and users only.