CVE-2019-1941: Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Security readout for executives and security teams

Cisco ISE had a web management interface flaw that could let an outside attacker run script in an administrator’s browser if they convinced that user to open a malicious link. This is not a direct server takeover, but it can expose browser-based information or influence the management session. Exposure is limited to organizations running Cisco ISE versions earlier than 2.4.0 Patch 9 or 2.6.0, especially where administrators access the management interface through browsers that may encounter attacker-controlled links. Handle through normal vulnerability management unless the affected ISE management interface is broadly reachable or used by many administrators. Prioritize patching because ISE is security infrastructure and management-session compromise can affect operational trust. Mitigation focus: Upgrade affected Cisco ISE deployments to 2.4.0 Patch 9, 2.6.0, or later fixed guidance.; Check the Cisco advisory before scheduling upgrades or compensating controls.; Reduce unnecessary exposure of the Cisco ISE web management interface..

Prepared

May 25, 2026, 04:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.