The vulnerability identified as CVE-2026-88743 affects Bacularis versions from 4.7.0 up to and including 6.5.0. It is a stored cross-site scripting (XSS) flaw located in the handling of director tags. Stored XSS vulnerabilities enable attackers to inject malicious scripts that are permanently stored on the target system and executed when users access the affected content. No further technical details or exploitation data are available.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable Bacularis application. This may lead to session hijacking, unauthorized actions, or data theft depending on the application context. There is no information about active exploitation in the wild or specific impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.