Security Advisory Desk
mediumQCS priority 82/100Cisco

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A weakness in the web interface of Cisco Integrated Management Controller (IMC) allows an attacker who is logged in remotely to trick another user into clicking a harmful link. This can let the attacker run malicious scripts in the user's web browser or steal sensitive information.

Published 5/8/2026, 4:00:00 pmVerified 5/8/2026, 8:16:18 pmRevision 1
Cisco medium network security advisory visual

In plain language

What this advisory means

A weakness in the web interface of Cisco Integrated Management Controller (IMC) allows an attacker who is logged in remotely to trick another user into clicking a harmful link. This can let the attacker run malicious scripts in the user's web browser or steal sensitive information.

Technical explanation

How the issue affects the environment

The Cisco IMC web management interface improperly validates user input, leading to a cross-site scripting (XSS) vulnerability (CWE-79). An authenticated attacker can remotely craft a specially designed URL that, when clicked by a user of the interface, injects and executes arbitrary script code in the victim's browser context. This may expose or manipulate data within the browser session or perform unauthorized actions under the user's privileges. The vulnerability impacts multiple hardware models running affected Cisco IMC versions. Cisco has provided fixed software releases to remediate this issue; no effective workaround is available.

Operational impact

Why teams should care

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the security context of a privileged user accessing the Cisco IMC web interface. This can lead to theft of sensitive management data, unauthorized actions on managed devices, and potential compromise of network infrastructure. The severity is rated medium, reflecting a significant but not critical impact. Organizations relying on Cisco IMC for management should promptly apply vendor updates to reduce risk.

Immediate action

To fully resolve this vulnerability, upgrade affected Cisco IMC software to the fixed releases specified for each affected product. Follow Cisco's recommended upgrade paths using Host Upgrade Utility (HUU) or firmware updates as documented by Cisco. Regularly monitor Cisco PSIRT advisories for updates and instructions.

Affected and fixed releases

Affected versionsVersions prior to fixed releases of Cisco IMC software on affected platforms
Fixed versionsCisco NFVIS 4.12.8 (ENCS and uCPE), Cisco NFVIS 4.18.5, UCS C-Series M5 4.2(3r), 4.3(2.260020), UCS C-Series M6 4.2(3r), 4.3(6.260054), 6.0(2.260143), UCS E-Series M3 3.2.18.1, UCS E-Series M6 4.15.4, UCS S-Series 4.3(6.260054)

Temporary risk reduction

There are no workarounds available that mitigate this vulnerability. The only way to address the risk is by applying the provided software updates from Cisco.

Evidence and validation checklist

  • Vendor advisory from Cisco PSIRT
  • CVE-2026-20198 identification
  • Description of XSS due to insufficient user input validation
  • List of affected products and software versions
  • Published fixed software versions
  • Statement of no available workaround
  • Medium severity rating
  • No known exploitation at disclosure

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source