CVE-2014-0681: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier al...

Security readout for executives and security teams

Cisco ISE report pages in version 1.2 patch 2 and earlier could mishandle a crafted URL and display attacker-supplied script or HTML. For leaders, the main concern is theft or misuse of a trusted administrator’s browser session if a vulnerable reporting workflow is reachable and used. Exposure is most likely in environments still running Cisco ISE 1.2 patch 2 or earlier. Risk is higher where ISE reporting functions are accessible to broader internal users or reachable from untrusted networks. The bundle does not identify other affected products. Treat this as a targeted hygiene issue, not a crisis based on the provided evidence. Prioritize remediation if vulnerable ISE systems remain in production, because ISE is identity infrastructure and administrator browser compromise can have outsized operational impact. Mitigation focus: Identify any Cisco ISE deployments and confirm exact version and patch level.; Consult Cisco’s CVE-2014-0681 notice for supported remediation or upgrade guidance.; Limit ISE administrative and reporting access to trusted management networks..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.