CVE-2026-6179 is a stored cross-site scripting vulnerability in FPT Software NightWolf Penetration Testing Platform version 2.1.5. It results from improper input neutralization during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity) and no known exploits in the wild. No official patch or remediation level has been disclosed by the vendor. The platform is self-hosted, so remediation requires vendor or user intervention.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected users' browsers. This may lead to session hijacking, unauthorized actions, or data theft within the scope of the affected application. However, there are no known active exploits reported. The impact is limited to users of the vulnerable version 2.1.5 of the NightWolf Penetration Testing Platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor FPT Software communications for updates. In the meantime, consider applying input validation or output encoding workarounds if feasible. No vendor advisory states that no action is required or that the issue is already mitigated.