CVE-2026-9144 is a stored cross-site scripting vulnerability (CWE-79) affecting Taiko Network Communications Pte Ltd.'s AG1000-01A SMS Alert Gateway version 7.3. The vulnerability exists in the embedded web configuration interface, where authenticated attackers can fragment malicious JavaScript payloads across multiple administrative form fields. By using JavaScript comments and template literals, attackers bypass front-end length restrictions and concatenate executable script fragments. These scripts are rendered persistently in administrative dashboard views such as index.zhtml, enabling persistent script execution within administrative sessions.

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript persistently within the administrative interface. This can lead to session hijacking, unauthorized actions within the administrative dashboard, and potential compromise of the device's management interface. The CVSS v3.1 score of 7.6 reflects high impact on confidentiality and integrity, with low impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid using version 7.3 in production environments if possible.