CVE-2026-20198
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. This is due to insufficient input validation, and exploitation involves persuading a user to click a crafted link. Successful exploitation could allow arbitrary script execution in the user's browser or access to sensitive browser-based information.
Risk Assessment
The risk includes potential session theft, account takeover, or leakage of sensitive browser data, which could compromise confidentiality and integrity.
Recommendation
It is recommended to update Cisco IMC to a patched version and educate users about clicking suspicious links. Also implement input filtering and output encoding.
Other vulnerabilities in Cisco Integrated Management Controller
See all- CVE-2014-8003High
Cisco Integrated Management Controller in Cisco Unified Computing System 2.2(2c)A and earlier allows local users to obtain shell access via a crafted map-nfs command.
- CVE-2026-20288Medium
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying OS and elevate privileges to root. This is due to improper input validation, and exploitation involves entering crafted inputs. Successful exploitation allows command execution as root.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.