CVE-2026-44960 Revive CVE debrief

Who should care

Administrators and users of the affected unknown vendor product should be aware of this vulnerability and take necessary steps to protect themselves. This vulnerability could potentially allow an attacker to inject malicious code into the system. Users should ensure they are running the latest version of the product with the proper escaping added to the audit log details output.

Technical summary

The vulnerability is a stored XSS that can be triggered when an admin user views the audit log details for affected entries. The exploit involves embedding malicious JavaScript payloads in usernames. The vulnerability was caused by missing output sanitisation. The fix involves adding proper escaping to the audit log details output. The CVSS vector is listed as CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N.

Defensive priority

High priority should be given to applying the fix, which involves adding proper escaping to the audit log details output. Administrators should ensure that all instances of the affected product are updated with the latest version.

Recommended defensive actions

• Apply the fix by adding proper escaping to the audit log details output
• Ensure all instances of the affected product are updated with the latest version
• Monitor the system for any suspicious activity
• Review and update the system's security configurations
• Educate users on the importance of secure coding practices

Evidence notes

The evidence for this CVE comes from the NVD and a HackerOne report. The NVD provides official vulnerability database information, while the HackerOne report provides additional details on the vulnerability. The CVE was published on 2026-06-23T17:17:00.230Z and last modified on 2026-06-25T19:52:36.573Z.

Official resources