CVE-2026-42693: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TieLabs Jannah

CVE-2026-42693 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in TieLabs Jannah software versions up to 7.6.5. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. The impact includes partial confidentiality, integrity, and availability loss. No known exploits in the wild or vendor patch information are provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected web pages. This can lead to partial loss of confidentiality, integrity, and availability, such as theft of user credentials, session hijacking, or manipulation of web content. The vulnerability requires user interaction but no privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls as temporary mitigations to reduce the risk of XSS. Monitor vendor channels for updates regarding patches or official mitigations.