Stored Cross-Site Scripting in Cisco FXOS and UCS Manager Management Interface
CVE-2026-20091

4.8MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Firepower Extensible Operating System (fxos)
Cisco Secure Firewall Adaptive Security Appliance (asa) Software
Cisco Unified Computing System (managed)
Vendor
CVE Published:
25 February 2026

Badges

👾 Exploit Exists

What is CVE-2026-20091?

An issue exists in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software, where insufficient validation of user input can lead to stored cross-site scripting (XSS) vulnerabilities. This allows an authenticated remote attacker with valid credentials to inject malicious scripts into specific pages within the interface. If successfully exploited, the attacker can execute arbitrary script code in the context of the interface or access sensitive browser-based information, putting system integrity and user data at risk.

Affected Version(s)

Cisco Firepower Extensible Operating System (FXOS) 2.14.1.131

Cisco Firepower Extensible Operating System (FXOS) 2.14.1.143

Cisco Firepower Extensible Operating System (FXOS) 2.14.1.163

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.