CVE-2026-34821 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The flaw exists in the remark parameter of the /manage/vpnauthentication/user/ page, allowing an authenticated attacker to inject arbitrary JavaScript code. This code is stored on the server and executed in the browsers of other users who view the affected page, potentially leading to session hijacking or other client-side attacks. The vulnerability requires authentication and user interaction (UI:P), and has a medium attack complexity (AC:L).

An authenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of other users' browsers when they view the affected page. This can lead to theft of session tokens, unauthorized actions performed on behalf of users, or other client-side impacts typical of stored XSS. The vulnerability does not allow privilege escalation or direct system compromise but poses a risk to user confidentiality and integrity within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates regarding an official patch or workaround.