A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software | unknown |
|
Configuration 1 [-]
|
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Cisco
Subscribe
|
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 30 Jan 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco identity Services Engine
|
|
| CPEs | cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:* |
|
| Vendors & Products |
Cisco identity Services Engine
|
Fri, 16 Jan 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco identity Services Engine Passive Identity Connector Cisco identity Services Engine Software |
|
| Vendors & Products |
Cisco
Cisco identity Services Engine Passive Identity Connector Cisco identity Services Engine Software |
Thu, 15 Jan 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 15 Jan 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. | |
| Title | Cisco Identity Services Engine Cross-Site Scripting Vulnerability | |
| Weaknesses | CWE-80 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2026-01-16T04:55:52.838Z
Reserved: 2025-10-08T11:59:15.355Z
Link: CVE-2026-20047
Vulnrichment
Updated: 2026-01-15T18:10:08.340Z
NVD
Status : Analyzed
Published: 2026-01-15T17:16:07.160
Modified: 2026-01-30T19:58:27.947
Link: CVE-2026-20047
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-01-16T13:43:23Z
Weaknesses