CVE-2026-28072 describes a reflected cross-site scripting vulnerability in PixFort pixfort Core (<= 3.2.22) caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in users' browsers when they interact with crafted links or inputs. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. However, exploitation requires user interaction, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted inputs and links. Monitor PixFort's official channels for updates regarding patches or mitigations.