CVE-2026-90443

Received Received - Intake

Reflected Cross-Site Scripting in Web Interface

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the user's browser to an arbitrary external site. Successful exploitation could allow an attacker to act with the compromised user's session privileges within the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90443

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves a web interface that reflects part of the request URL into a script context and a hyperlink attribute without proper encoding. It also lacks authentication requirements, allowing unauthenticated attackers to craft malicious links. When a user visits such a link, arbitrary script executes in the application context and can redirect the user to an external site.

Detection Guidance

This vulnerability involves reflected cross-site scripting (XSS) via URL reflection in a web interface without authentication. To detect it, inspect web server logs for unusual URL patterns containing script tags or suspicious query parameters. Check if the application reflects user input in URLs without proper encoding.

Impact Analysis

An attacker could steal session cookies or sensitive data, perform actions on your behalf within the application, or trick you into visiting malicious sites. This may lead to account takeover, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face fines or penalties for failing to protect user data adequately.

Mitigation Strategies

Immediately apply input validation and output encoding to sanitize reflected URLs. Ensure all user-supplied data is properly escaped before rendering in HTML, JavaScript, or hyperlink contexts. Restrict unauthenticated access to sensitive endpoints if possible.

Hi! I’m here to help you understand CVE-2026-90443. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70