VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Apr 15, 2026· Updated Jul 2, 2026

CVE-2026-20132

CVE-2026-20132

Description

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.

These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

17
  • Cisco Systems, Inc./Identity Services Engine Software16 versions
    cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*range: <3.2.0
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*
    • cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*
  • Cisco Systems, Inc./Identity Services Engine Expressllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.