CVE-2026-26352 is a stored cross-site scripting vulnerability in Smoothwall Express prior to version 3.1 Update 13. The issue exists in the /cgi-bin/vpnmain.cgi script due to improper neutralization of input in the VPN_IP parameter. Authenticated attackers can inject malicious JavaScript code through VPN configuration settings, which is then executed in the context of other users viewing the affected page. This vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 5.1, indicating medium severity.

An authenticated attacker can inject and execute arbitrary JavaScript code in the context of other users by exploiting the improper input sanitization of the VPN_IP parameter. This can lead to session hijacking, unauthorized actions, or other malicious activities performed on behalf of the victim user. However, the attack requires authentication and user interaction (viewing the affected page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or update link is provided and no official fix is mentioned, users should monitor Smoothwall advisories for updates addressing this vulnerability. In the meantime, restrict access to the VPN configuration interface to trusted users only and consider additional input validation or filtering controls if possible.