CVE-2026-27508 is a reflected cross-site scripting vulnerability in Smoothwall Express affecting versions prior to 3.1 Update 13. The issue arises from improper neutralization of input in the url parameter of the /redirect.cgi endpoint, enabling injection of JavaScript code via crafted URLs. This can lead to execution of arbitrary scripts in the context of the victim's browser session.

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, phishing, or other client-side attacks. However, no known exploits are reported in the wild, and the vulnerability requires user interaction (clicking a malicious link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Smoothwall advisories for updates. In the meantime, avoid clicking suspicious links involving the /redirect.cgi endpoint and consider implementing web filtering or input validation controls if possible.