CVE-2026-92976

MediumCVSS 5.1

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

20th percentile - higher than 20% of all known CVEs

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the profile management functionality of T-Systems' TAO 2.0 suite. An authenticated user can inject malicious HTML or JavaScript into personal data fields, which are displayed without proper sanitization to other users, including administrators.

Risk Assessment

Exploitation could allow script execution in the victim's browser, access to session information, or actions with the victim's permissions.

Recommendation

Upgrade to a patched version and implement input sanitization mechanisms.

Other vulnerabilities in TAO 2.0

CVE-2026-7185Medium
A validation vulnerability has been identified in file management or upload features in the TAO 2.0 suite. This flaw allows an attacker to access file system resources outside the intended scope of the application.

Original NVD description (English source)

A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being properly sanitised when another user, including administrative staff, views the affected profile. Successful exploitation could allow JavaScript code to be executed in the victim’s browser, access to information available within the session, or the performance of actions using the victim’s permissions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS