The vulnerability allows an authenticated, remote attacker who has administrative write privileges on Cisco Identity Services Engine to inject malicious script payloads into the web‑based management interface. Stored or reflected cross‑site scripting could execute in the victim’s browser context, giving the attacker the ability to run arbitrary code, read sensitive data stored in the browser, or hijack the user session. The impact on confidentiality, integrity, or availability is limited to the user interacting with the compromised web page and does not provide full system compromise.

Cisco Identity Services Engine Software. Version information is not specified in the advisory.

With a CVSS score of 4.8 the vulnerability is considered moderate. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated admin user and relies on a victim clicking a malicious link or visiting an affected page, making the attack vector indirect but still feasible for attackers with the necessary access. The overall risk is moderate for environments where administrative credentials are shared or where users have write access to the management interface.