CVE-2026-39991
MediumCVSS 4.8Summary
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. The vulnerability has been fixed in version 3.9.12 and later.
Risk Assessment
Injection of malicious code may lead to session theft, account takeover, or actions performed on behalf of the user.
Recommendation
Update Notes Station 3 to version 3.9.12 or later and restrict access to the application to trusted users only.
Other vulnerabilities in Notes Station 3
See all- CVE-2026-34009High
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-34008High
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-34007Medium
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in version 3.9.11 and later.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS