CVE-2026-34816 is a stored cross-site scripting (XSS) vulnerability in Endian Firewall versions up to 3.3.25. The issue arises from improper neutralization of input in the domain parameter of the /manage/smtpscan/domainrouting/ web page. An attacker with authentication privileges can inject arbitrary JavaScript code that is stored on the server and executed in the context of other users who access the affected page. This can lead to client-side script execution, potentially allowing session hijacking or other malicious actions within the user's browser context. The vulnerability is classified under CWE-79 and has a CVSS 4.0 score of 5.1, indicating medium severity.

The vulnerability allows an authenticated attacker to perform stored XSS attacks by injecting malicious scripts into the domain parameter. When other users view the affected page, the injected script executes in their browsers, potentially leading to unauthorized actions such as session hijacking or information disclosure within the context of the web application. The impact is limited to authenticated users due to the requirement for authentication to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected functionality to trusted users only and consider additional input validation or web application firewall rules to detect and block malicious input targeting the domain parameter.