CVE-2026-18360 is a stored cross-site scripting (CWE-79) vulnerability in the IRIS web application (iris-web) version 2.4.26. The issue arises from improper neutralization of input during web page generation in the custom attributes function, enabling an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 7.6, reflecting network attack vector, low attack complexity, low privileges required, and user interaction needed, with a scope change and high confidentiality impact but limited integrity impact.

Successful exploitation can lead to disclosure of sensitive information (high confidentiality impact) and partial integrity compromise due to script injection. Availability is not affected. The vulnerability requires user interaction and low privileges, but the scope of impact extends beyond the vulnerable component.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected version 2.4.26 and apply any available workarounds recommended by the vendor. Monitor for updates from the vendor regarding patches or mitigations.