This vulnerability (CVE-2026-66610) is an unauthenticated Cross Site Scripting (XSS) flaw in Urna software versions up to 2.6.2. It allows remote attackers to inject and execute arbitrary scripts in users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network attack vector, low complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability does not require authentication and has low attack complexity, increasing the risk of exploitation. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewalls or input validation controls to mitigate potential exploitation. Monitor official vendor channels for updates and patches.