CVE-2026-26723: Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 8.2 High.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Implement strict input validation and output encoding on the 'function' parameter and all user-supplied inputs to prevent injection of malicious scripts.
- Deploy Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in browsers.
- Educate users to recognize and avoid suspicious links or unexpected interactions that could trigger XSS attacks.
- Monitor web application logs and network traffic for unusual patterns indicative of exploitation attempts.
- Isolate the affected application within network segments to limit lateral movement if compromised.
- Engage with Key Systems Inc to obtain patches or updates addressing this vulnerability as soon as they become available.
- Employ web application firewalls (WAF) with rules targeting XSS attack patterns to provide an additional layer of defense.
- Conduct regular security assessments and penetration testing focusing on input validation and client-side security controls.
- Review and update incident response plans to include scenarios involving XSS exploitation and data exfiltration.
- Limit user privileges and session lifetimes to reduce the impact of stolen credentials or session tokens.
Description
Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to execute arbitrary code via the function parameter.