CVE-2026-33553 is a cross-site scripting (XSS) vulnerability affecting Northern.tech CFEngine Enterprise versions >=3.24.3 <3.24.4 and >=3.27.0 <3.27.1. This vulnerability allows attackers to inject malicious scripts that execute in the context of a victim's browser, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with a scope change and partial confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's session, potentially leading to partial disclosure of information and modification of data accessible to the user. The vulnerability does not impact system availability. The attack requires user interaction and network access but no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available workarounds recommended by the vendor. Monitor vendor communications for updates on patches or mitigations.