CVE-2026-18516: CWE-116: Improper Encoding or Escaping of Output in Arcadia Technology, LLC Crafty Controller

This vulnerability (CVE-2026-18516) in Crafty Controller arises from improper output encoding or escaping in the Audit Logs component. An attacker can exploit this flaw by injecting malicious scripts through HTTP headers, which are then stored and executed in the context of the application, leading to stored cross-site scripting. The flaw allows remote, unauthenticated attackers to execute arbitrary scripts, potentially compromising user sessions, data integrity, and system availability.

Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system. Attackers may execute arbitrary scripts in users' browsers, potentially stealing sensitive information, performing actions on behalf of users, or disrupting system operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply any recommended workarounds from the vendor and consider restricting access to the Audit Logs component or sanitizing HTTP headers at network boundaries if feasible.