CVE-2026-20132— Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20132
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
Source: NVD (National Vulnerability Database)
Vulnerability Description
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device. These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Identity Services Engine 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Identity Services Engine（Cisco ISE）是美国思科（Cisco）公司的一款环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco Identity Services Engine存在安全漏洞，该漏洞源于用户提供的数据清理不足，可能导致具有管理写入权限的经过身份验证的远程攻击者执行存储型或反射型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 3.1.0 | - |
II. Public POCs for CVE-2026-20132
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20132
请登录查看更多情报信息。
Same Patch Batch · Cisco · 2026-04-15 · 15 CVEs total
| CVE-2026-20180 | 9.9 CRITICAL | Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability |
| CVE-2026-20186 | 9.9 CRITICAL | Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability |
| CVE-2026-20147 | 9.9 CRITICAL | Cisco Identity Services Engine Remote Code Execution Vulnerability |
| CVE-2026-20184 | 9.8 CRITICAL | Cisco Webex Meetings Certificate Validation Vulnerability |
| CVE-2026-20081 | 6.5 MEDIUM | Cisco Unity Connection Arbitrary File Download Vulnerability |
| CVE-2026-20078 | 6.5 MEDIUM | Cisco Unity Connection Arbitrary File Download Vulnerability |
| CVE-2026-20059 | 6.1 MEDIUM | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability |
| CVE-2026-20170 | 6.1 MEDIUM | Cisco Webex Contact Center 安全漏洞 |
| CVE-2026-20136 | 6.0 MEDIUM | Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability |
| CVE-2026-20161 | 5.5 MEDIUM | Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability |
| CVE-2026-20152 | 5.3 MEDIUM | Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability |
| CVE-2026-20148 | 4.9 MEDIUM | Cisco Identity Services Engine Path Traversal Vulnerability |
| CVE-2026-20060 | 4.7 MEDIUM | Cisco Unity Connection Open Redirect Vulnerability |
| CVE-2026-20061 | 4.3 MEDIUM | Cisco Unity Connection SQL Injection Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Identity Services Engine Software
- CVE-2026-20193
Cisco Identity Services Engine Authentication Bypass Vulnera - CVE-2026-20195
Cisco Identity Services Engine Observable Response Discrepan - CVE-2026-20136
Cisco Identity Services Engine Authenticated Privilege Escal - CVE-2026-20180
Cisco Identity Services Engine Multiple Remote Code Executio - CVE-2026-20186
Cisco Identity Services Engine Multiple Authenticated Remote
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2026-20132
No comments yet