Stored XSS in NSP Workflow Application

Executive Summary

CVE-2026-40464 is a stored Cross-Site Scripting (XSS) vulnerability in Nokia's Network Services Platform (NSP). It occurs due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow app could inject malicious code that executes when other users view the affected content.

Useful 0 Not Useful 0

Detection Guidance

Detecting this stored XSS vulnerability requires checking for improper input validation in the Nokia NSP workflow application. Inspect web application logs for suspicious user input containing script tags or event handlers. Use tools like Burp Suite or OWASP ZAP to scan for XSS vulnerabilities in the NSP workflow interface.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. This could lead to unauthorized access to sensitive data, session hijacking, or defacement of web pages. Users with access to the workflow application are at risk if they view compromised content.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS vulnerabilities can lead to breaches of confidentiality and integrity of user data, which may violate GDPR and HIPAA requirements. Organizations using affected NSP versions could face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NSP to a patched version (24.11-SP15, 25.11-SP5, 26.4, or later). If immediate patching is not possible, restrict access to the workflow application to trusted users only and implement strict input validation for user-controlled fields.

Useful 0 Not Useful 0