CVE-2026-19810: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Broadcom Symantec Endpoint Detection and Response

CVE-2026-19810 is an XSS vulnerability (CWE-79) in Broadcom Symantec Endpoint Detection and Response Console version 4.12. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts that execute within the context of other users' sessions. This could allow attackers to access functionality or information normally restricted to the affected user.

Successful exploitation may result in unauthorized access to functionality or information within the SEDR Console that is normally restricted to the targeted user. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, requiring low privileges and user interaction, with partial confidentiality and integrity impact but no availability impact.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider limiting access to the affected version.