PatchSiren cyber security CVE debrief

CVE-2026-48535 GFI Software CVE debrief

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page. This vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Vendor: GFI Software
Product: GFI Archiver
CVSS: MEDIUM 5.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-23
Original CVE updated: 2026-07-27
Advisory published: 2026-07-23
Advisory updated: 2026-07-27

Who should care

Users of GFI Archiver versions before 15.13 should be aware of this vulnerability and take steps to mitigate it. This includes administrators and security teams responsible for the affected product, as well as operators and platform owners who may be impacted by the vulnerability.

Technical summary

The vulnerability exists in the Call Home proxy server configuration of GFI Archiver before 15.13. Authenticated attackers can inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page. The CVSS score for this vulnerability is 5.1, indicating a moderate level of severity.

Defensive priority

Medium

Recommended defensive actions

Apply the vendor-provided patch or upgrade to version 15.13 or later
Restrict access to the Call Home proxy server configuration
Monitor for suspicious activity on the General Settings Additional Settings page
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-23T16:17:25.903Z and was last modified on 2026-07-27T17:16:36.327Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in the Call Home proxy server configuration of GFI Archiver before 15.13.

Sources and references

Verified primary and authoritative sources

CVE-2026-48535 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-48535

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-48535 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48535

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases

[email protected]
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/gfi-archiver-stored-xss-via-callhomesettingswizard-aspx

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.