Reflected XSS in URL Handling

Publication date: 2026-05-28

Last updated on: 2026-06-01

Assigner: Tenable Network Security, Inc.

Description

A reflected cross-site scripting issue exists in URL handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-01

Generated

2026-07-09

AI Q&A

2026-05-29

EPSS Evaluated

2026-07-08

NVD

CVE-2026-9646

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue that exists in URL handling.

Impact Analysis

The vulnerability can allow an attacker to execute malicious scripts in the context of a user's browser by exploiting the URL handling. This can lead to limited confidentiality and integrity impacts, as indicated by the CVSS score.

Hi! I’m here to help you understand CVE-2026-9646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70