PatchSiren cyber security CVE debrief

CVE-2026-89290 İzometri IT Services Domestic and Foreign Trade Co. Ltd. CVE debrief

PatchSiren debrief for CVE-2026-89290: HTML Injection in İzometri Informatics' eimzamip. The vulnerability is a stored XSS issue affecting eimzamip versions from v1.6.4 to v1.6.6. Defenders should assess exposure and prioritize patching. The CVE record and source item provide details on the vulnerability. The NVD entry is currently not provided. This issue requires verification and patching of affected versions to prevent potential attacks. The vulnerability exists due to improper neutralization of script-related HTML tags.

Vendor: İzometri IT Services Domestic and Foreign Trade Co. Ltd.
Product: eimzamip
CVSS: LOW 3.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-08
Original CVE updated: 2026-10-08
Advisory published: 2026-10-08
Advisory updated: 2026-10-08

Who should care

Defenders responsible for İzometri Informatics' eimzamip systems should assess exposure and prioritize patching. They should review and update inventory of affected systems and monitor for potential XSS attacks. The vulnerability requires verification and patching of affected versions to prevent potential attacks. Defenders should also consider compensating controls for exposed systems while remediation is scheduled.

Why it matters

CVE-2026-89290 is a stored XSS vulnerability in eimzamip that requires verification and patching of affected versions to prevent potential attacks.

Potential for stored XSS attacks
Need for verification of eimzamip versions and patching
Monitoring for potential attacks
Inventory updates for affected systems

Technical summary

A stored XSS vulnerability exists in eimzamip due to improper neutralization of script-related HTML tags. The issue affects eimzamip versions from v1.6.4 to v1.6.6. The vulnerability requires verification and patching of affected versions to prevent potential attacks. The CVE record and source item provide details on the vulnerability. Defenders should prioritize verifying and patching eimzamip versions between v1.6.4 and v1.6.7.

Defensive priority

Defenders should prioritize verifying and patching eimzamip versions between v1.6.4 and v1.6.7.

Recommended defensive actions

Verify eimzamip version and apply patch if necessary
Review and update inventory of affected systems
Monitor for potential XSS attacks

Evidence notes

The CVE record and source item provide details on the HTML injection vulnerability in eimzamip. The NVD entry is currently not provided. The vulnerability affects eimzamip versions from v1.6.4 to v1.6.6. Defenders should verify and patch affected systems. The source confidence is limited, and further verification is required.

Sources and references

Verified primary and authoritative sources

CVE-2026-89290 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-89290

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-89290 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89290

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

HTML Injection in İzometri Informatics' eimzamip
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89290.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275

Supplemental source - government-resource

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.