CVE-2026-11747: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Seres Software syWEB

This vulnerability (CVE-2026-11747) in Seres Software syWEB is due to improper input neutralization during web page generation, leading to reflected cross-site scripting (CWE-79). An attacker can exploit this flaw by injecting malicious scripts that are reflected back in the web page, potentially impacting confidentiality and integrity but not availability. The product is not supported by the vendor, and no patch or official fix has been provided. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or manipulation of web content. There is no indication of impact on system availability. The vulnerability requires user interaction and can be exploited remotely over the network. Since the product is no longer supported, affected users may remain exposed without an official fix.

No official patch or remediation is available as the product is not supported by the vendor. Users should consider discontinuing use of syWEB or implementing compensating controls such as web application firewalls or input validation proxies to mitigate reflected XSS risks. Monitor vendor channels for any updates, but currently no vendor-provided fix exists.