CVE-2026-22675 is a stored cross-site scripting vulnerability in OCS Inventory NG Server (<=2.12.3). Attackers can exploit this by sending malicious User-Agent HTTP headers to the /ocsinventory endpoint. These headers are stored and later displayed in the web console's statistics dashboard without adequate input neutralization or output encoding, enabling arbitrary JavaScript execution in authenticated users' browsers. The vulnerability requires no authentication to inject the payload but affects authenticated users who view the dashboard. No official patch or remediation level has been published yet.

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of authenticated users' browsers when they access the statistics dashboard. This can lead to session hijacking, unauthorized actions, or other malicious activities within the web console environment. However, exploitation requires the victim to be an authenticated user viewing the affected interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the statistics dashboard to trusted users only and monitor for suspicious User-Agent header submissions. Avoid exposing the web console to untrusted networks. No official remediation or temporary fix has been published at this time.