CVE-2026-40464

MediumCVSS 5.4

Published: 31/08/2026(UTC)Updated: 03/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

NSP is vulnerable to stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker can embed malicious code that executes when another user views the content.

Risk Assessment

An attacker can steal session data or take over other users' accounts, compromising confidentiality and integrity.

Recommendation

Apply proper output encoding and input validation in the workflow application.

Other vulnerabilities in NSP

CVE-2026-40465Medium
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

Original NVD description (English source)

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS