CVE-2026-34802 is a stored cross-site scripting (CWE-79) vulnerability affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the remark user ham spam parameter of the /cgi-bin/salearn.cgi endpoint, allowing authenticated users to inject arbitrary JavaScript code. This code is stored on the server and executed in the browsers of other users who access the affected page, potentially leading to unauthorized script execution within the context of the vulnerable application.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of other users viewing the affected page. This can lead to session hijacking, unauthorized actions, or other malicious behaviors within the scope of the Endian Firewall web interface. The vulnerability is rated medium severity with a CVSS score of 5.1, indicating a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider applying web application firewall rules to detect and block malicious input targeting the remark user ham spam parameter. Monitor vendor communications for updates on patches or official mitigations.