{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20132", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.380Z", "datePublished": "2026-04-15T16:03:14.842Z", "dateUpdated": "2026-04-15T17:06:38.222Z"}, "containers": {"cna": {"title": "Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.\r\n\r\nThese vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U", "name": "cisco-sa-isexss-BS8ctE7U"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-isexss-BS8ctE7U", "discovery": "EXTERNAL", "defects": ["CSCwn87479"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "cwe", "cweId": "CWE-79"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p2", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.3.0", "status": "affected"}, {"version": "3.2.0 p3", "status": "affected"}, {"version": "3.2.0 p4", "status": "affected"}, {"version": "3.1.0 p8", "status": "affected"}, {"version": "3.2.0 p5", "status": "affected"}, {"version": "3.2.0 p6", "status": "affected"}, {"version": "3.1.0 p9", "status": "affected"}, {"version": "3.3 Patch 2", "status": "affected"}, {"version": "3.3 Patch 1", "status": "affected"}, {"version": "3.3 Patch 3", "status": "affected"}, {"version": "3.4.0", "status": "affected"}, {"version": "3.2.0 p7", "status": "affected"}, {"version": "3.3 Patch 4", "status": "affected"}, {"version": "3.4 Patch 1", "status": "affected"}, {"version": "3.1.0 p10", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:14.842Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:55.291064Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:06:38.222Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20132", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.380Z", "datePublished": "2026-04-15T16:03:14.842Z", "dateUpdated": "2026-04-15T16:03:14.842Z"}, "containers": {"cna": {"title": "Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.\r\n\r\nThese vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U", "name": "cisco-sa-isexss-BS8ctE7U"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-isexss-BS8ctE7U", "discovery": "EXTERNAL", "defects": ["CSCwn87479"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "cwe", "cweId": "CWE-79"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p2", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.3.0", "status": "affected"}, {"version": "3.2.0 p3", "status": "affected"}, {"version": "3.2.0 p4", "status": "affected"}, {"version": "3.1.0 p8", "status": "affected"}, {"version": "3.2.0 p5", "status": "affected"}, {"version": "3.2.0 p6", "status": "affected"}, {"version": "3.1.0 p9", "status": "affected"}, {"version": "3.3 Patch 2", "status": "affected"}, {"version": "3.3 Patch 1", "status": "affected"}, {"version": "3.3 Patch 3", "status": "affected"}, {"version": "3.4.0", "status": "affected"}, {"version": "3.2.0 p7", "status": "affected"}, {"version": "3.3 Patch 4", "status": "affected"}, {"version": "3.4 Patch 1", "status": "affected"}, {"version": "3.1.0 p10", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:14.842Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:55.291064Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-15T16:56:38.817Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.\r\n\r\nThese vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information."}], "id": "CVE-2026-20132", "lastModified": "2026-04-17T15:09:46.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "psirt@cisco.com", "type": "Primary"}]}, "published": "2026-04-15T17:17:01.967", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@cisco.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3 Patch 2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3 Patch 1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3 Patch 3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2.0 p7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.3 Patch 4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.4 Patch 1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.1.0 p10"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "Cisco Identity Services Engine Software", "source": "cna", "vendor": "Cisco"}, "product": "identity_services_engine_software", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-15T22:19:19.246192+00:00", "value": {"mitigation_remediation": ["Apply the Cisco Identity Services Engine patch or upgrade published in the official Cisco advisory.", "Restrict administrative write access and ensure only trusted personnel can manage the web\u2011based interface.", "Disable unused web\u2011based management features or harden the web server configuration to reduce the attack surface."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Cisco Identity Services Engine Software. Version information is not specified in the advisory.", "description_and_impact": "The vulnerability allows an authenticated, remote attacker who has administrative write privileges on Cisco Identity Services Engine to inject malicious script payloads into the web\u2011based management interface. Stored or reflected cross\u2011site scripting could execute in the victim\u2019s browser context, giving the attacker the ability to run arbitrary code, read sensitive data stored in the browser, or hijack the user session. The impact on confidentiality, integrity, or availability is limited to the user interacting with the compromised web page and does not provide full system compromise.", "risk_and_exploitability": "With a CVSS score of 4.8 the vulnerability is considered moderate. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated admin user and relies on a victim clicking a malicious link or visiting an affected page, making the attack vector indirect but still feasible for attackers with the necessary access. The overall risk is moderate for environments where administrative credentials are shared or where users have write access to the management interface."}}}}, "created": "2026-04-15T20:45:06.101868+00:00", "updated": "2026-04-15T22:30:16.058842+00:00", "vendors": ["cisco", "cisco$PRODUCT$identity_services_engine_software"]}