CVE-2026-22675 is a stored cross-site scripting vulnerability in OCS Inventory NG Server (version 2.12.3 and prior). The issue arises because the application accepts User-Agent HTTP headers from unauthenticated requests to the /ocsinventory endpoint and stores them without proper input neutralization. When these stored values are displayed in the web console's statistics dashboard, insufficient encoding allows execution of arbitrary JavaScript in the context of authenticated users. This vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch is currently available, and the product is not a cloud service.

An attacker can inject malicious JavaScript code that executes in the browsers of authenticated users viewing the statistics dashboard. This can lead to session hijacking, unauthorized actions within the web console, or other attacks facilitated by script execution in the victim's browser. However, exploitation requires the attacker to submit crafted User-Agent headers and relies on authenticated users viewing the affected dashboard. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the statistics dashboard to trusted users only and monitor for suspicious User-Agent header submissions. Avoid exposing the /ocsinventory endpoint to untrusted networks if possible. Do not rely on generic mitigations; await vendor guidance for a definitive fix.