CVE-2026-18741

Executive Summary

CVE-2026-18741 is a stored cross-site scripting (XSS) vulnerability in Worksuite SaaS (versions prior to 6.0.14), specifically within the Asset Management module. An authenticated administrator can inject arbitrary JavaScript into the Location and Description fields when creating an asset; the payload is persisted to the application database and executes in the browser of any user who subsequently views the affected asset. Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed in the context of authenticated users, with a CVSS base score of 4.8 (Medium).

Technical Analysis

The vulnerability is a classic stored (persistent) XSS flaw mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack surface is the Asset Management module of the Worksuite SaaS application. When an authenticated administrator creates a new asset, user-controlled input accepted in the Location and Description fields is not adequately sanitized or encoded before being stored. Crafted HTML containing <script> tags — or other executable markup such as event-handler attributes — is saved verbatim into the application's database. No technical detail is provided in the NVD description regarding the exact server-side rendering framework, template engine, or input-validation routine involved; it is therefore not possible to name specific functions, classes, or code paths. The vulnerability class, however, implies a missing or insufficient output-encoding step at the point where stored asset data is rendered back into HTML for viewing.

The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) is consistent with this behavior: the attack is reachable over the network (AV:N), requires no special conditions beyond reaching the vulnerable form (AC:L), demands high privileges for the injection step (PR:H — the attacker must be an authenticated administrator), and requires a separate user to view the malicious asset for execution (UI:R). The scope is changed (S:C) because the injected script executes in the context of the victim's browser session against the application origin, not merely within the asset data itself. Confidentiality and integrity impact are both rated Low (C:L/I:L), reflecting the typical constraints of an XSS primitive (e.g., reading session tokens, performing in-session actions) rather than direct server compromise. Availability impact is None (A:N). With an EPSS score of 0.00148 (4.5th percentile), the vulnerability currently shows a very low probability of exploitation in the wild, and it is absent from the CISA Known Exploited Vulnerabilities (KEV) catalog.

Exploitation Scenarios

The following attack chain is inferred from the NVD description and the XSS vulnerability class. No public PoC, Nuclei template, or exploit code is available; the chain is therefore a reconstruction based on the described behavior.

1. Reconnaissance / target identification: The attacker identifies a Worksuite SaaS instance running a version prior to 6.0.14. Because the injection requires administrator privileges, the attacker first obtains or compromises a valid administrative account — for example, through phishing, credential reuse, or insider access. Public-facing SaaS login pages and admin user directories are the initial touchpoints.

2. Triggering the flaw: With an authenticated administrator session, the attacker navigates to the Asset Management module and opens the "create new asset" workflow. The attacker enters a malicious payload into the Location field, the Description field, or both. Crafted HTML <script> tags (or equivalent executable markup, such as <img onerror=...> or <svg onload=...>) are submitted to the server as normal form data.

3. Payload persistence and execution: The application persists the unsanitized payload to its database without proper output encoding. Any time another user — including regular employees, managers, or other administrators — views the affected asset, the stored markup is rendered by the browser and the embedded script executes automatically in that user's session. The execution occurs in the context of the victim's authenticated Worksuite session and the application's origin.

4. Post-exploitation impact: The injected script can read and exfiltrate session cookies or authentication tokens, enabling session hijacking. It can also render fake credential-harvesting forms within the trusted application origin, or invoke authenticated API/administrative actions on behalf of the victim, leading to data modification, unauthorized asset changes, or further account compromise. Because the payload persists until removed, every subsequent viewer is a potential victim, making this a durable, multi-victim compromise vector.

Impact Assessment

The primary business impact is confidentiality and integrity loss for authenticated users of the Worksuite SaaS platform. Although the entry requires high privileges (an administrator account), the blast radius is broad: the stored payload executes for any user who views the affected asset, so a single injection can affect the entire user base of the tenant. In a multi-tenant SaaS deployment, if asset data is shared or cross-tenant visibility exists, the impact could extend beyond a single organization. Realistic consequences include theft of session credentials, exfiltration of data visible in the victim's session, and forged or unauthorized actions (asset edits, approvals, or settings changes) performed under a victim's identity. Availability is not directly impacted. The CVSS subscores (Confidentiality: Low, Integrity: Low, Availability: None) reflect that the vulnerability provides browser-context access rather than direct server or data-at-rest compromise; however, the scope change (S:C) and persistent, multi-user execution profile elevate the real-world risk above the raw Medium severity. The absence of a confirmed patch (patch confidence 0/4) means affected deployments remain exposed indefinitely until a fix is verified or compensating controls are applied.

Detection Guidance

The following detection content is generic and should be tuned to the specific web server, proxy, and logging schema of the deployment. Rules focus on the observable signature of the vulnerability class — HTML/script payloads submitted to asset-creation endpoints and reflected in stored asset views.

Sigma Rule

title: Worksuite Asset Creation Request with Stored XSS Payload (CVE-2026-18741)
id: 1b6d4123-9f0a-4c1e-b2d1-8f3e6a70c9a2
status: experimental
description: Detects POST requests to asset-management functionality containing script tags or XSS event-handler payloads in Location/Description parameters, indicating an attempt to exploit CVE-2026-18741.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18741
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: web
    product: generic
detection:
    selection:
        http.method: POST
        http.url|contains: asset
    filter_known_good:
        http.url|contains:
            - /static/
            - /api/v1/assets/export
    xss_keywords:
        - '*<script>*'
        - '*</script>*'
        - '*onerror=*'
        - '*onload=*'
        - '*javascript:*'
        - '*<svg*'
        - '*<img*'
    condition: selection and xss_keywords and not filter_known_good
falsepositives:
    - Legitimate use of HTML formatting inside asset descriptions, if the application intentionally permits rich text
level: high
tags:
    - attack.t1190
    - cve.2026.18741
    - cwe.79

YARA Rule

rule CVE_2026_18741_Worksuite_Stored_XSS_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects stored XSS payloads targeting the Worksuite Asset Management module (CVE-2026-18741)"
        cve = "CVE-2026-18741"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18741"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $script_open = "<script"
        $script_close = "</script>"
        $onerror = "onerror=" ascii nocase
        $onload = "onload=" ascii nocase
        $js_proto = "javascript:" ascii nocase
        $field_location = "location" ascii nocase
        $field_description = "description" ascii nocase
        $asset_ref = "asset" ascii nocase
    condition:
        filesize < 5MB and
        ($script_open and $script_close) and
        2 of ($onerror, $onload, $js_proto) and
        ($field_location or $field_description) and
        $asset_ref
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-18741 - Worksuite Stored XSS Attempt in Asset Location/Description Fields"; flow:established,to_server; content:"POST"; http_method; content:"asset"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/is"; pcre:"/(onerror|onload|onmouseover|javascript:)[^\r\n]*/i"; http_request_body; classtype:web-application-attack; reference:cve,2026-18741; sid:10018741; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: This rule inspects HTTP request bodies for the combination of a <script> block and event-handler/javascript payload markers in POSTs to URIs containing "asset". Tune the http_uri content match to the actual asset-management path observed in your environment.

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
    url.path like "*asset*" and
    (wildcard(http.request.body.original, "*<script>*", "*onerror=*", "*onload=*", "*javascript:*", "*<svg*")) ]
  [ network where network.protocol == "http" and http.response.status_code == 200 and
    url.path like "*asset*" ]

Splunk SPL Query

index=proxy OR index=web sourcetype=*http*
| where method="POST"
| eval body_lower=lower(form_data)
| where like(body_lower, "%<script%") OR like(body_lower, "%onerror=%") OR like(body_lower, "%onload=%") OR like(body_lower, "%javascript:%")
| where like(uri_path, "%asset%")
| table _time, src_ip, dest_host, uri_path, form_data, user
| sort - _time

Wazuh OSSEC Rule

<rule id="100741" level="10">
  <decoded_as>web</decoded_as>
  <description>CVE-2026-18741 - Stored XSS payload submitted to Worksuite Asset Management (Location/Description fields)</description>
  <field name="method">POST</field>
  <regex> asset </regex>
  <regex> (&lt;script|onerror=|onload=|javascript:) </regex>
  <group>web_application_attack,xss,cve-2026-18741,attack.t1190,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence has been identified from any tracked source, and the vendor fix is listed as N/A. The NVD description implies versions prior to 6.0.14 are vulnerable and that 6.0.14 addresses the flaw, but no official advisory or release artifact has been verified. Until a patch is confirmed, treat the application as exposed and apply the following controls:

1. Immediate mitigations:

• Restrict administrator accounts to only trusted personnel and enforce phishing-resistant multi-factor authentication, since the injection requires an authenticated administrator.
• Deploy a Web Application Firewall (WAF) with rules that block script tags and event-handler payloads (e.g., <script>, onerror=, onload=, javascript:) in POST bodies to asset-management endpoints.
• If feasible, manually review or re-encode previously stored asset records; scan the database for asset Location/Description values containing HTML/script markup and neutralize them.
• Apply a Content Security Policy (CSP) that disallows inline script execution (e.g., script-src 'self' 'nonce-...'), which substantially reduces the impact of stored XSS even if a payload reaches the browser.

2. Patch/upgrade steps:

• Monitor vendor channels (Thomas Eichmann / Worksuite release notes) for an official 6.0.14 or later release.
• As soon as a verified patched build is available, upgrade all Worksuite SaaS instances and tenants to version 6.0.14 or higher. In the absence of a verified patch, short-term protections above are mandatory; do not assume the vulnerability is closed merely because a version number is referenced.

3. Long-term hardening:

• Introduce a formal secure-development review of the Asset Management module, focusing on input validation and context-aware output encoding for all user-supplied fields.
• Add automated security testing (SAST/DAST) with XSS-specific test cases to the CI/CD pipeline for the Worksuite codebase.
• Audit access to administrator roles and enforce least-privilege principles; consider separating asset-administration duties from general user administration.
• Establish monitoring rules (as provided in the Detection Guidance section) and alert on repeated XSS-payload submissions from administrative accounts.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18741
• CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (Exploit Prediction Scoring System) — CVE-2026-18741: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-18741): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory, researcher blog, or threat-actor campaign referencing CVE-2026-18741 was identified during analysis. There is no evidence of exploitation in the wild, no public PoC, and no Nuclei template coverage as of the time of reporting.