CVE-2026-16969 is a stored cross-site scripting (CWE-79) vulnerability in the IRIS web application (iris-web) version 2.4.26. The flaw exists in the assets function where input is not properly neutralized during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability requires network access, low attack complexity, low privileges, and user interaction. It impacts confidentiality highly, with limited impact on integrity and no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of authenticated users, potentially exposing sensitive information (high confidentiality impact) and causing limited integrity issues. There is no direct impact on system availability. The vulnerability requires user interaction and low privileges, which may limit exploitation scenarios but still poses a significant risk to user data confidentiality.

No official patch or remediation level has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input in the assets function and consider applying temporary mitigations such as input validation or output encoding if feasible.