Stored XSS in Bacularis Director Tags

Executive Summary

CVE-2026-88743 is a Stored Cross-Site Scripting (XSS) vulnerability in Bacularis versions 4.7.0 to 6.5.0. It allows attackers to inject malicious scripts via the Director / Configure director / JobDefs section by creating global tags with XSS payloads in the tag name. When executed, the payload runs for all users viewing jobs or interacting with the application.

Useful 0 Not Useful 0

Detection Guidance

Check Bacularis version to confirm if it falls within 4.7.0 to 6.5.0. Inspect Director / Configure director / JobDefs sections for global tags containing suspicious payloads like <script> tags. Monitor network traffic for unauthorized tag creation requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary scripts in the context of other users' browsers. This may lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of users. Both admin and normal users are affected.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS vulnerabilities like CVE-2026-88743 can lead to non-compliance with GDPR and HIPAA by enabling unauthorized script execution that may steal user data or session tokens. GDPR requires protection against data breaches, while HIPAA mandates safeguards for protected health information. Exploitation could result in data exposure, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Bacularis to version 6.5.1 or later immediately. Remove any suspicious global tags with XSS payloads from the Director / Configure director / JobDefs sections. Review user permissions to ensure only authorized users can create or modify tags.

Useful 0 Not Useful 0