CVE-2026-20089

Vulnerability

Overview CVE-2026-20089 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC). The root cause is insufficient validation of user input, allowing an attacker to inject malicious script that is stored on the server and later served to other users [1].

Exploitation

Conditions To exploit this vulnerability, an attacker must be authenticated with administrative privileges on the affected Cisco IMC instance. The attacker then crafts a malicious link and persuades a user of the interface to click it. No additional network access is required beyond the management interface [1].

Impact

Successful exploitation enables the attacker to execute arbitrary script code in the browser of the targeted user. This could lead to theft of session tokens, manipulation of interface content, or access to sensitive browser-based information [1].

Mitigation

Cisco has released software updates that address this vulnerability. There are no workarounds. Affected products include 5000 Series ENCS, Catalyst 8300 Series Edge uCPE, UCS C-Series M5/M6, and UCS E-Series M3/M6 servers [1].