CVE-2026-20091: Cisco FXOS & UCS Manager XSS Vulnerability

CVE-2026-20091 Overview

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software. This vulnerability allows an authenticated, remote attacker with administrative privileges to inject malicious scripts that execute in the context of other users accessing the interface.

The vulnerability stems from insufficient validation of user-supplied input by the web-based management interface. An attacker can exploit this by injecting malicious data into specific pages of the interface, which is then stored and executed when other users view the affected pages.

Critical Impact

Successful exploitation enables attackers to execute arbitrary script code in the context of the affected interface and potentially access sensitive browser-based information from other administrative users.

Affected Products

• Cisco FXOS Software (Web-based Management Interface)
• Cisco UCS Manager Software (Web-based Management Interface)

Discovery Timeline

• 2026-02-25 - CVE-2026-20091 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-20091

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) affects the web-based management interface of Cisco FXOS and UCS Manager software. Unlike reflected XSS attacks, stored XSS is particularly dangerous because the malicious payload persists on the server and executes automatically when users access the affected pages.

The attack requires the attacker to possess valid administrative credentials—specifically, accounts with the role of Administrator or AAA Administrator. While this requirement limits the initial attack surface, it represents a significant risk in environments where multiple administrators access the management interface or where administrative credentials may have been compromised through other means.

The scope of this vulnerability extends beyond the vulnerable component itself, as indicated by the changed scope designation in the vulnerability assessment. This means successful exploitation can impact resources beyond the security scope of the vulnerable component.

Root Cause

The root cause of this vulnerability is insufficient validation and sanitization of user-supplied input in the web-based management interface. The affected system fails to properly encode or filter malicious script content before storing it in the application's database or rendering it in web pages. This allows attackers to inject JavaScript or other client-side scripts that are subsequently executed in victims' browsers.

Attack Vector

The attack is conducted remotely over the network through the web-based management interface. An attacker must first authenticate with valid administrative credentials to inject the malicious payload into specific pages of the interface.

The attack sequence involves:

1. The attacker authenticates to the web management interface using Administrator or AAA Administrator credentials
2. The attacker navigates to vulnerable input fields or pages within the interface
3. Malicious script code is injected and stored by the application
4. When other administrators access the affected pages, the stored script executes in their browser context
5. The attacker can then steal session tokens, perform actions on behalf of the victim, or exfiltrate sensitive information displayed in the interface

Detection Methods for CVE-2026-20091

Indicators of Compromise

• Unexpected JavaScript or HTML tags appearing in administrative configuration fields or logs
• Unusual script execution or browser behavior when accessing the UCS Manager or FXOS web interface
• Session anomalies indicating potential session hijacking following interface access
• Audit logs showing modifications to interface pages or configuration entries containing script content

Detection Strategies

• Enable and monitor web application firewall (WAF) rules to detect XSS payload patterns in HTTP requests
• Review audit logs for configuration changes made by administrative accounts that contain suspicious HTML or JavaScript content
• Implement browser-based security controls such as Content Security Policy (CSP) headers to help mitigate script execution
• Deploy endpoint detection solutions to identify anomalous browser behavior during management interface sessions

Monitoring Recommendations

• Enable comprehensive logging for all administrative actions in Cisco UCS Manager and FXOS interfaces
• Monitor for unusual administrative session activity or multiple sessions from unexpected locations
• Configure alerts for configuration changes that contain script-like patterns or encoded content
• Review authentication logs for suspicious access patterns to administrative accounts

How to Mitigate CVE-2026-20091

Immediate Actions Required

• Review Cisco's security advisory and apply available patches immediately
• Audit administrative accounts and ensure only authorized personnel have Administrator or AAA Administrator roles
• Review recent configuration changes for any signs of injected malicious content
• Consider temporarily restricting access to the web-based management interface to trusted networks only

Patch Information

Cisco has released a security advisory addressing this vulnerability. Organizations should review the Cisco Security Advisory for specific patch versions and upgrade guidance for affected FXOS and UCS Manager software deployments.

Workarounds

• Restrict access to the web-based management interface to trusted IP addresses using firewall rules or access control lists
• Implement multi-factor authentication for administrative accounts to reduce the risk of credential compromise
• Use CLI-based management where possible as an alternative to the web interface
• Ensure administrative accounts follow the principle of least privilege—only assign Administrator or AAA Administrator roles when absolutely necessary
• Enable browser security features and use browsers with strong XSS protection when accessing the management interface

# Example: Restrict management interface access via ACL
# Apply access control to limit web management interface access to trusted networks
# Consult Cisco documentation for specific configuration syntax for your deployment