CVE-2025-20289
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Multiple reflected XSS vulnerabilities exist in the web-based management interface of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in the victim's context.
Risk Assessment
An attacker with at least a low-privileged account could execute script in an administrator's or other user's browser, potentially leading to data theft or privilege escalation. Organizations using Cisco ISE are exposed to attacks requiring only a basic account.
Recommendation
Apply Cisco ISE and ISE-PIC updates containing fixes for CVE-2025-20289. Restrict management interface access to trusted networks and review account permissions.
Related vulnerabilities
- CVE-2026-54143Critical
In OpenHuman before version 0.57.13, an attacker able to send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers.
- CVE-2026-54141Critical
In OpenHuman before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic AgentTurnRequest using the default tool policy without an interactive approval context. ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows node_exec to run despite the default Supervised policy requiring approval.
- CVE-2026-119344Critical
Cocos AI in version 0.8.2 and earlier accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. The vulnerability is addressed in 0.9.0, but cannot be patched in source code alone since it arises from the confidential computing threat model itself.
- CVE-2026-83542Critical
A Code Injection vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding mainDecoratorLocation, causing evaluation of an unsandboxed Groovy expression.
- CVE-2026-82907Critical
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker who captures a live externalLoginKey to obtain a complete session as the issuing user across all webapps, because the key is accepted as a bearer credential never bound to a client, never expires, and is not invalidated after use.
- CVE-2026-117691Critical
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
- CVE-2026-96677Critical
Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.
- CVE-2026-73117Critical
HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.
- CVE-2026-73116Critical
Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.
- CVE-2026-73101Critical
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.
Original NVD description (English source)
Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS