The vulnerability exists in the web‑based management interface of Cisco FXOS Software and Cisco UCS Manager Software. It is a stored cross‑site scripting flaw caused by insufficient validation of user‑supplied input. An attacker with valid Administrator or AAA Administrator credentials can inject malicious data into specific pages. If successfully exploited, the attacker can execute arbitrary script code in the context of the interface or access sensitive, browser‑based information, potentially compromising session data, credentials, or other sensitive information.

The affected vendors include Cisco, and the affected products are Cisco Firepower Extensible Operating System (FXOS), Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Unified Computing System (Managed). Aggrieved version details are not publicly listed in the CNA data, so organizations should verify if their deployed FXOS or UCS Manager versions match the impacted release lines. Since the CVE was identified in the web interface, any deployment that includes the affected management interface is potentially vulnerable.

The CVSS base score is 4.8, indicating a moderate impact. The EPSS score is below 1%, showing a low current likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Successful exploitation requires an authenticated user with administrative privileges. Attackers would need to log into the management interface to inject the payload. Thus, the risk is primarily internal or to compromised credentials, but a publicly exposed management interface could be exploited by attackers who obtain or guess credentials.