CVE-2026-12580 is a stored cross-site scripting vulnerability in Digiwin EasyFlow .NET. It allows authenticated remote attackers to inject persistent JavaScript code that executes in the browsers of users viewing the affected pages. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation enables attackers with authenticated access to inject persistent malicious scripts, which execute in the context of other users' browsers. This can lead to session hijacking, unauthorized actions, or data theft within the scope of the affected application. However, exploitation requires authentication and user interaction (page load).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted users only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor vendor communications for updates on official fixes.