Stored Cross-Site Scripting Vulnerability in Cisco Identity Services Engine Management Interface

CVE-2026-20076

What is CVE-2026-20076?

A vulnerability exists in the web-based management interface of Cisco Identity Services Engine that allows authenticated remote attackers to perform stored cross-site scripting (XSS) attacks. The issue stems from inadequate validation of user-supplied input, enabling an attacker to inject malicious scripts into specific pages of the interface. A successful attack could execute arbitrary script code in the context of the management interface, potentially leading to unauthorized access to sensitive browser-based information. Exploiting this vulnerability requires valid administrative credentials.

References