CVE-2026-20091

Vulnerability

Overview

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software. The root cause is insufficient validation of user-supplied input by the interface [1]. This allows an authenticated attacker to store malicious scripts that will be executed when other users access the affected pages.

Exploitation

Conditions

To exploit this vulnerability, an attacker must have valid credentials for a user account with the role of Administrator or AAA Administrator [1]. The attacker injects malicious data into specific pages of the interface. No additional network access or user interaction beyond the victim viewing the page is required.

Impact

A successful exploit enables the attacker to execute arbitrary script code in the context of the affected interface. This could lead to session hijacking, defacement, or access to sensitive browser-based information such as cookies or session tokens [1].

Mitigation

Cisco has released software updates to address this vulnerability. The advisory recommends upgrading to a fixed release as the only complete remediation. No workarounds are provided; any temporary mitigations are considered interim solutions [1].