PT-2026-27795 · Cisco · Cisco Iox+1

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-20112

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A flaw exists in the web-based management interface of the Cisco IOx application hosting environment. This issue could allow a remote attacker with valid administrative credentials to execute a stored cross-site scripting (XSS) attack against a user. The root cause is insufficient validation of user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code within the affected interface or gain access to sensitive information accessible through the browser. The attacker must possess valid administrative credentials to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06542

CVE-2026-20112

Affected Products

Cisco Ios Xe

Cisco Iox

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-20112 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-xss-LpGkzwtJ · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06542 · Security Note
• https://twitter.com/CVEnew/status/2038618147159261198 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2036984814101029305 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1s4so3w/cisco_addresses_serious_vulnerabilities_in_ios · Reddit Post
• https://reddit.com/r/pwnhub/comments/1s3q3cp/cisco_catalyst_switch_vulnerabilities_could_lead · Reddit Post