CVE-2026-71189

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: ICS-CERT

Description

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-71189

EUVD

EUVD-2026-89476

Affected Vendors & Products

Vendor	Product	Version / Range
Toptech	Systems	TMS7 7.6.3
Toptech	Systems	TopHAT 7.6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to inject malicious JavaScript code into a user's browser session by tricking another application user into issuing a specially crafted request. The injected code executes within the victim's active session.

Detection Guidance

This vulnerability is a reflected cross-site scripting (XSS) issue where attacker-supplied JavaScript executes in a user's browser session. Detection involves inspecting web application traffic for suspicious input patterns or unusual JavaScript execution. Monitor browser console logs for unexpected scripts and review server logs for requests containing script tags or event handlers like onerror or onload.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or access sensitive data within your application session. This may lead to unauthorized account access or data theft.

Compliance Impact

This vulnerability could result in unauthorized data access or exfiltration, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations and penalties if exploited.

Mitigation Strategies

Implement input validation and sanitization for user-supplied data to prevent JavaScript injection. Ensure all user inputs are properly escaped before rendering in the browser. Use Content Security Policy (CSP) headers to restrict inline scripts and unauthorized sources.

Hi! I’m here to help you understand CVE-2026-71189. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70