Stored Cross-Site Scripting Vulnerability in Cisco IOS XE Software

CVE-2026-20112

What is CVE-2026-20112?

A vulnerability in Cisco IOS XE software's web-based management interface can be exploited by an authenticated remote attacker to perform a stored cross-site scripting attack. This weakness arises from inadequate validation of user input, allowing an attacker to inject malicious scripts into certain pages. If successfully exploited, an attacker can run arbitrary scripts within the interface's context or gain access to sensitive browser information. To carry out this attack, the attacker must possess valid administrative credentials.

References