CVE-2026-95717
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS. An authenticated remote attacker with high privileges could inject malicious scripts. Successful exploitation could execute arbitrary script code in the context of another authenticated user's browser session.
Risk Assessment
An attacker could run scripts in other administrators' sessions, capture data, or perform actions on their behalf. This may lead to privilege escalation and further system compromise.
Recommendation
Apply vendor updates that fix the XSS vulnerability. Restrict access to the management interface and enforce a Content Security Policy.
Other vulnerabilities in AOS
See all- CVE-2026-79872Critical
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- CVE-2026-79852Critical
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS