CVE-2026-16969 is a stored cross-site scripting (XSS) vulnerability in the IRIS web application (iris-web) version 2.4.26. The issue arises from improper neutralization of input during web page generation within the assets function, which could allow an attacker to inject and execute malicious scripts. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality highly while integrity is impacted to a lesser extent. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited integrity impact. Availability is not affected. The attack requires network access, low complexity, and some user interaction with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates regarding patches or official mitigations.