CVE-2026-23752 is a stored cross-site scripting vulnerability in GFI Software HelpDesk before version 4.99.9. It arises due to improper neutralization of input in the companyname POST parameter during template group creation and editing. Authenticated administrators can inject arbitrary JavaScript code, which is then stored and executed in the browsers of other administrators viewing the Templates > Groups page. This vulnerability requires administrator privileges and user interaction (viewing the page) to trigger. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond administrator, and partial impact on integrity and availability.

Successful exploitation allows an authenticated administrator to inject and execute arbitrary JavaScript in the context of other administrators' browsers. This can lead to actions such as session hijacking, unauthorized actions performed on behalf of the administrator, or other malicious activities within the HelpDesk administrative interface. The impact is limited to users with administrator privileges and requires them to view the affected page. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when entering data into the companyname field in template group creation and editing. Restrict administrative access to trusted personnel only. Monitor vendor communications for updates regarding patches or official mitigations.