The vulnerability CVE-2026-8309 involves improper input neutralization during web page generation in the Access Control System (GKS) by Armiya Information Technologies Ltd. Co., resulting in a reflected cross-site scripting (XSS) flaw. This allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects versions prior to 2. No vendor advisory or patch information is available, and no known exploits have been reported.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to disclosure of sensitive information or manipulation of web content. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official workarounds.