The vulnerability CVE-2026-7677 affects kerwincui FastBee up to version 1.2.1 in the System Notice Handler's Add function. It arises from improper handling of the noticeContent parameter in the SysNoticeController.java source file, enabling cross-site scripting attacks. The flaw can be exploited remotely without privileges or user interaction, but with limited impact on confidentiality and integrity. The vendor was notified but has not issued a fix or advisory. No patches or mitigations have been published, and no known exploits are currently observed in the wild.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the noticeContent parameter. This could lead to execution of arbitrary scripts in the context of the affected application, potentially impacting users who view the manipulated notices. The CVSS score of 5.1 reflects a medium severity with network attack vector, low complexity, no privileges required, and partial impact on integrity and availability. There is no indication of direct data breach or system takeover from the available information.

No official patch or remediation is currently available from the vendor, who has not responded to the vulnerability disclosure. Users should monitor the vendor's communications for any future updates or fixes. Until a fix is released, consider applying input validation or sanitization on the noticeContent parameter at the application or web server level to mitigate XSS risks. Avoid exposing the vulnerable functionality to untrusted users if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.