This vulnerability (CVE-2026-8284) in Universal Software Inc. FlexCity is classified as CWE-601 (URL redirection to untrusted site, or open redirect). It allows an attacker to manipulate input data to redirect users to potentially malicious external sites. The affected versions are from 5.536.0 before 5.542.0. The CVSS 3.1 vector indicates the attack is network-based with low attack complexity, no privileges required, but requires user interaction. The scope is changed (S:C), and the impact is limited to low confidentiality and integrity impacts without affecting availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation can cause users to be redirected to untrusted external sites, potentially facilitating phishing or social engineering attacks. The impact is limited to partial confidentiality and integrity loss, with no availability impact. There is no indication of direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs and input parameters that may trigger redirection. Implementing input validation or URL allowlisting on the application side may reduce risk. Monitor vendor communications for updates.