CVE-2026-34815 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the DOMAIN parameter of the /cgi-bin/smtpdomains.cgi endpoint. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored persistently and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no information about an available patch or vendor advisory for remediation.

Successful exploitation allows an authenticated attacker to inject and store malicious JavaScript code that executes in the browsers of other users who view the affected page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability requires authentication and user interaction (viewing the page). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected functionality to trusted users and consider additional input validation or output encoding controls if possible. Monitor vendor communications for updates on official patches or mitigations.