Cross-site Scripting Vulnerability in Cisco Identity Services Engine

CVE-2026-20132

What is CVE-2026-20132?

The web-based management interface for Cisco Identity Services Engine (ISE) has multiple vulnerabilities that allow an authenticated remote attacker with administrative write privileges to execute stored and reflected cross-site scripting (XSS) attacks. This is primarily due to insufficient sanitization of user-supplied data stored in the web page. An attacker could exploit these weaknesses by persuading users to click on malicious links or access compromised web pages, potentially leading to the execution of injected script code within the interface context or gaining access to sensitive browser information.

References