CVE-2026-32963 is a reflected XSS vulnerability in silex technology, Inc.'s SD-330AC and AMC Manager products (versions 1.42 and earlier). When a user logs into the device and visits a crafted web page, arbitrary scripts may execute in the user's browser, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.0 score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No official fix or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the logged-in user's browser, potentially leading to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction (the user must access a crafted web page) and does not require privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when accessing untrusted web pages while logged into affected devices. No official mitigation or temporary fix has been provided by the vendor at this time.