Skip to content
NewA calmer, faster ZeroHour
Advisorylow

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Cisco Security Advisories ()2 · 1 read
Read at sec.cloudapps.cisco.com
Part of a story covered by 14 sourcesCisco ISE September 2026 hardening release fixes actively exploited authentication bypass CVE-2026-76460 plus RCE, SQL injection, XXE and path traversal flawsMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

Cisco patched a reflected XSS in the ISE management interface allowing unauthenticated attackers to execute script via crafted links.

A reflected cross-site scripting vulnerability in the web-based management interface of Cisco Identity Services Engine lets an unauthenticated remote attacker execute arbitrary script in the context of the interface. Exploitation requires persuading a user to click a crafted link due to improper input validation. Cisco has released software updates.

Key facts
  • Unauthenticated reflected XSS in ISE management interface
  • Requires convincing a user to click a crafted link
  • Could expose sensitive browser-based information
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ciscoidentity-services-enginemanagement-interfacepatchxss
Vendors
Cisco
Products
Cisco Identity Services Engine
Organizations
Cisco

From the original article

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input.

Cisco Security Advisories

sec.cloudapps.cisco.com

Read the full article at Cisco Security Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.