The vulnerability identified as CVE-2026-6179 affects NightWolf Penetration Testing Platform version 2.1.5 by FPT Software. It is classified as CWE-79, indicating improper neutralization of input leading to stored cross-site scripting. This flaw enables attackers to store malicious scripts that execute in the context of users' browsers when they view affected pages. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, but with high scope and low impact on confidentiality and availability, and limited impact on integrity. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability allows attackers to execute arbitrary scripts in the browsers of users interacting with the vulnerable NightWolf platform. This can lead to session hijacking, defacement, or other malicious actions performed in the context of the affected user. However, the impact is rated medium severity with limited integrity impact and no direct impact on confidentiality or availability according to the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by FPT Software, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected version and applying web application firewall rules to detect and block potential XSS payloads relevant to this vulnerability.