CVE-2026-18360
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session theft or data exfiltration.
Recommendation
Update the IRIS application to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in IRIS
See all- CVE-2026-18362Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
- CVE-2026-16971Medium
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
- CVE-2026-16970Medium
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
- CVE-2026-16969High
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
- CVE-2026-42547Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
- CVE-2026-42543Medium
IRIS platform prior to version 2.4.28 is vulnerable to a CSRF attack because it uses the HTTP GET method to change server state. An attacker can exploit this to perform unauthorized actions on behalf of the victim.
- CVE-2026-42540Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests.
- CVE-2026-42539Medium
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
- CVE-2026-42538Medium
IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-42329Medium
Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.
Original NVD description (English source)
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.