Medium [CVE-2026-20132] Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
This medium-severity Cisco advisory covers CVE-2026-20132 affecting ISE, Identity Services Engine Software.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device.
These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page.
The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
Affected products named by the advisory: Identity Services Engine Software.
- Scope: These vulnerabilities affect Cisco ISE, regardless of device configuration.
- 3.1 and earlier — Migrate to a fixed release
- Release 3.2 (first fixed: 3.2 Patch 8)
- Release 3.3 (first fixed: 3.3 Patch 5)
- Release 3.4 (first fixed: 3.4 Patch 2)
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 3.2 Patch 8
- 3.3 Patch 5
- 3.4 Patch 2
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release 3.1 and earlier: migrate to a fixed release.
- Release 3.2: upgrade to 3.2 Patch 8.
- Release 3.3: upgrade to 3.3 Patch 5.
- Release 3.4: upgrade to 3.4 Patch 2.
- There are no workarounds that address these vulnerabilities.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.