CVE-2026-26719 describes a Cross Site Scripting (CWE-79) vulnerability in xxl-job-admin version 3.0.0. The vulnerability enables remote attackers to execute arbitrary code via a specially crafted HTTP GET request that includes malicious script code. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary script code in the context of the affected application, potentially leading to partial confidentiality and integrity loss. There is no indication of availability impact. The vulnerability requires user interaction and can be triggered remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the affected version and applying any recommended workarounds from the vendor once published.