CVE-2026-40464: Vulnerability in Nokia NSP

CVE-2026-40464 is a stored XSS vulnerability in Nokia NSP's workflow application caused by improper validation or encoding of user-controlled input. This allows an authenticated attacker to inject malicious script code that executes in the context of other users viewing the workflow content. The vulnerability affects multiple specific versions of Nokia NSP. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality and integrity but no impact on availability.

An attacker with authenticated access to the workflow application can inject malicious scripts that execute in other users' browsers when they view the compromised content. This can lead to partial confidentiality and integrity loss, such as theft or manipulation of sensitive data accessible in the user's session context. There is no reported impact on system availability. No known active exploitation has been reported.

No official patch or remediation level has been provided by Nokia as of the publication date. Users should monitor vendor advisories for updates. Until a fix is available, restricting workflow application access to trusted users and exercising caution when interacting with workflow content may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.