CVE-2026-29964 is a Cross-Site Scripting (XSS) vulnerability in HSC MailInspector v5.3.3-7, specifically in the /tap/tap.php endpoint. The vulnerability is due to improper output encoding of user-controlled input, which is reflected unsanitized in HTTP responses. This allows remote attackers to execute arbitrary JavaScript code in the context of users' browsers, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 6.1 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability. No patch or official remediation level has been published yet.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability requires user interaction and does not require privileges, making it moderately exploitable but not trivial.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall rules or input validation controls to mitigate reflected XSS risks. Avoid clicking suspicious links that may exploit this vulnerability. Monitor vendor channels for updates and patches.