Description
A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious data into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials for a user account with the role of Administrator or AAA Administrator.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Firepower Extensible Operating System (FXOS) | 2.14.1.131; 2.14.1.143; 2.14.1.163; 2.14.1.167; 2.16.0.128 |
| Cisco | Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | 9.12.2; 9.12.1; 9.12.3; 9.12.4; 9.12.3.2; 9.12.3.12; 9.12.2.5; 9.12.1.2; 9.12.2.1; 9.12.3.7; 9.12.2.9; 9.12.3.9; 9.12.1.3; 9.12.4.2; 9.12.4.4; 9.12.4.7; 9.12.4.8; 9.12.4.10; 9.12.4.13; 9.12.4.18 |
| Cisco | Cisco Unified Computing System (Managed) | 4.0(4h); 4.1(1a); 4.0(1c); 4.0(4a); 4.0(1a); 4.0(1d); 4.1(1c); 4.0(2a); 4.0(4g); 4.0(2e); 4.0(4c); 4.0(4f); 4.0(1b); 4.0(2b); 4.0(2d); 4.1(1b); 4.0(4d); 4.0(4e); 4.0(4b); 4.1(2a) |
References
Timeline
- Published
- Feb 25, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Deferred