CVE-2026-20309
Last modified
CVE-2026-20309 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link.
Description
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 3.1.0; 3.1.0 p1; 3.1.0 p3; 3.1.0 p2; 3.2.0; 3.1.0 p4; 3.1.0 p5; 3.2.0 p1; 3.1.0 p6; 3.2.0 p2; 3.1.0 p7; 3.3.0; 3.2.0 p3; 3.2.0 p4; 3.1.0 p8; 3.2.0 p5; 3.2.0 p6; 3.1.0 p9; 3.3 Patch 2; 3.3 Patch 1; 3.3 Patch 3; 3.4.0; 3.2.0 p7; 3.3 Patch 4; 3.4 Patch 1; 3.1.0 p10; 3.3 Patch 5; 3.3 Patch 6; 3.4 Patch 2; 3.3 Patch 7; 3.4 Patch 3; 3.5.0; 3.4 Patch 4; 3.3 Patch 8; 3.2 Patch 8; 3.5 Patch 1; 3.3 Patch 9; 3.2 Patch 9; 3.4 Patch 5; 3.5 Patch 3; 3.5 Patch 2; 3.3 Patch 10; 3.3 Patch 11; 3.4 Patch 6; 3.2 Patch 10; 3.1.0 p72; 3.1.0 p11 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-20309?
How severe is CVE-2026-20309?
How do I fix CVE-2026-20309?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-20303As part of Cisco's ongoing commitment to proactive security …9.9
- CVE-2026-20304As part of Cisco's ongoing commitment to proactive security …9.9
- CVE-2026-20305A vulnerability in the diagnostic tools of Cisco ISE and ISE…9.1
- CVE-2026-20306A vulnerability in the REST API of Cisco ISE and ISE-PIC cou…9.1
- CVE-2026-20307A vulnerability in the web-based management interface of Cis…9.9
- CVE-2026-20308A vulnerability in the web-based management interface of Cis…4.3
- CVE-2026-2031An Improper Access Control vulnerability in several internal…10
- CVE-2026-20310As part of Cisco's ongoing commitment to proactive security …9.1
- CVE-2026-20311A vulnerability in the web-based management interface of Cis…6.3
- CVE-2026-20312As part of Cisco's ongoing commitment to proactive security …8.8
- CVE-2026-20313As part of Cisco's ongoing commitment to proactive security …7.7
- CVE-2026-20314A vulnerability in Cisco Packaged Contact Center Enterprise …5
Are you affected by CVE-2026-20309?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST