CVE-2026-25786 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-25786 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-25786 is a stored or reflected cross-site scripting (XSS) vulnerability affecting the web interface of an industrial device, specifically the "communication" parameters page where PLC and station names are rendered without proper validation or sanitization.

Technical Detail

The flaw exists because the affected device's web interface fails to properly validate and sanitize user-controlled input, specifically PLC or station name values, before rendering them on the communication parameters page. An authenticated attacker with sufficient authorization can inject malicious script content into these name fields, which is then executed in the browser context of other users who view the affected page. Depending on session handling and privilege levels present in the environment, successful exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of higher-privileged users within the device's management interface.

Exploitation Status

No known exploit code has been publicly identified for this vulnerability at this time. The exploit maturity is currently assessed as none, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. This status should be monitored, as industrial device web interface vulnerabilities of this class have historically attracted post-disclosure exploit development.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been confirmed in association with this CVE. Given the industrial device context, organizations operating OT and ICS environments should treat this as a relevant risk, but no evidence of targeted exploitation by named actors has been established.

What To Do

Apply vendor-supplied patches as soon as they become available, prioritizing any devices with web interfaces exposed to untrusted network segments or accessible by multiple user accounts. As an interim measure, restrict access to the device web interface to only trusted administrators using network-level controls such as firewall rules or VLAN segmentation. Avoid exposing industrial device management interfaces directly to corporate or external networks. Monitor web interface access logs for anomalous input patterns in PLC or station name fields. Specific affected product details have not been confirmed in available data, so organizations should consult the vendor advisory associated with this CVE to identify affected firmware versions and obtain patching guidance.