# CVE-2026-20198: Cisco Integrated Management Controller cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-20198-cisco-integrated-management-controller-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20198 · Severity: medium · CVSS 4.8 · Published 2026-08-05

Cisco Integrated Management Controller (IMC) is a web-based management interface used to administer Cisco server hardware and appliances. A cross-site scripting vulnerability in IMC could allow an authenticated attacker to trick a user into clicking a malicious link, potentially stealing session data or executing commands in the context of the victim's browser session.

Technologies: [Cisco Catalyst 8300 Series Edge uCPE](https://junglewise.ai/threats/technologies/catalyst-8300-series-edge-ucpe). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20198 being exploited in the wild.

**How severe is CVE-2026-20198?** Medium severity, with a CVSS score of 4.8, published 5 August 2026.

**Which products and versions are affected?** Cisco 5000 Series ENCS NFVIS 4.12, 4.15 affected; see advisory; Cisco Catalyst 8300 Series Edge uCPE NFVIS 4.12, 4.15, 4.18, 26.1 affected; see advisory; Cisco Integrated Management Controller Multiple versions affected; see fixed software table; Cisco UCS C-Series M5 Rack Server Earlier than 4.2(3r), 4.3 before 4.3(2.260020); and 4 more.

**Is there a fix for CVE-2026-20198?** A patch was published on 2026-08-05: Fixed releases available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20198 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20198?** Check whether you run Cisco 5000 Series ENCS, Cisco Catalyst 8300 Series Edge uCPE, Cisco Integrated Management Controller or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a reflected or stored cross-site scripting (XSS) flaw (CWE-79) in the Cisco IMC web-based management interface stemming from insufficient input validation. The vulnerability requires an authenticated attacker with network access to the IMC interface and user interaction (the victim must click a crafted link). An attacker can exploit this to execute arbitrary JavaScript in the victim's browser, potentially accessing sensitive browser-based information, stealing session tokens, or performing administrative actions on behalf of the victim. Cisco has released fixed software versions for affected platforms; no workarounds are available.

## Affected products

- Cisco Integrated Management Controller Multiple versions affected; see fixed software table
- Cisco UCS C-Series M5 Rack Server Earlier than 4.2(3r), 4.3 before 4.3(2.260020)
- Cisco UCS C-Series M6 Rack Server Earlier than 4.2(3r), 4.3 before 4.3(6.260054), 6.0 before 6.0(2.260143)
- Cisco UCS E-Series M3 Affected; see advisory
- Cisco UCS E-Series M6 Affected; see advisory
- Cisco UCS S-Series Storage Server Affected; see advisory
- Cisco Catalyst 8300 Series Edge uCPE NFVIS 4.12, 4.15, 4.18, 26.1 affected; see advisory
- Cisco 5000 Series ENCS NFVIS 4.12, 4.15 affected; see advisory

## Timeline

- 2026-08-05: disclosed: CVE-2026-20198 published
- 2026-08-05: patched: Fixed releases available

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-7EhBFxBp)

## Related threats

- [Cisco Integrated Management Controller argument injection in web interface](https://junglewise.ai/threats/cve-2026-20288-cisco-integrated-management-controller-argument-injection-in-web)
- [Cisco IMC argument injection in web management interface](https://junglewise.ai/threats/cve-2026-20200-cisco-imc-argument-injection-in-web-management-interface)