CVE-2026-19810

Executive Summary

CVE-2026-19810 is a Cross-Site Scripting (XSS) vulnerability affecting the Symantec Endpoint Detection and Response (SEDR) Console in versions prior to 4.13. A network-adjacent attacker with low privileges can inject malicious script that executes in the context of another authenticated user's session, potentially granting access to functionality or information normally restricted to that user. The vulnerability is rated CVSS 5.4 (Medium), and no public proof-of-concept, exploit code, or CISA KEV listing currently exists, but exploitation opportunities may exist where the affected console is internet-exposed or used as a hypervisor/virtualization management interface in an ESXi context.

Technical Analysis

CVE-2026-19810 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting). According to the NVD description, the SEDR Console prior to version 4.13 "may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user's session, potentially resulting in unauthorized access to functionality or information normally restricted to that user."

The provided description does not disclose the precise vulnerable endpoint, parameter, or reflection/storage characteristics of the flaw. Based strictly on the vulnerability class and the CVSS vector, the following can be established with confidence:

• Attack Vector (AV:N) — the flaw is exploitable remotely over the network, meaning the injection point is reachable through the SEDR Console's web interface rather than requiring local host access.
• Attack Complexity (AC:L) — no special conditions or race conditions are required; the injection is straightforward once a suitable input vector is identified.
• Privileges Required (PR:L) — the attacker needs some form of low-privileged access or an authenticated foothold capable of submitting input to the vulnerable component.
• User Interaction (UI:R) — successful exploitation requires a victim user (e.g., an administrator or SOC analyst viewing the SEDR Console) to interact with a crafted request or page.
• Scope (S:C) — the vulnerability can impact resources beyond the vulnerable component's security scope; script executing in the victim's session context can reach adjacent console functionality or data.
• Confidentiality (C:L) / Integrity (I:L) — limited but meaningful exposure of information and limited ability to modify data within the victim's session.

Because the description is sparse, the exact rendering sink (reflected vs. stored) and the input surface (form field, URL parameter, log entry, search box) cannot be confirmed from available data. Threat-intel reporting must be treated at the vulnerability-class level: an attacker who can place script into a page rendered by the SEDR Console may have that script executed in the context of a privileged user who views the page, allowing theft of session tokens, CSRF-like actions against the console, or exfiltration of console-visible security data.

The vulnerable component is the SEDR Console, an administrative web interface used to manage endpoint detection and response operations. Because this console is typically deployed on internal management networks and is operated by security staff with high privileges, XSS in this context is more consequential than a comparable flaw in a low-privilege web application: the victim session may have visibility into endpoint telemetry, containment actions, and policy configuration.

Patch evidence: No vendor patch reference, advisory URL, or fix commit was captured in any tracked source. Patch confidence is 0/4 and the status is UNPATCHED per tracked data. The version boundary ("prior to 4.13") suggests that 4.13 or later may include a fix, but this is derived only from the NVD description and is not confirmed by a vendor advisory in the provided data.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-19810. The following attack chain is therefore inferred strictly from the vulnerability class (CWE-79) and the CVSS vector provided. No specific function names, endpoints, parameter names, or file paths are asserted because none appear in the source data.

1. Reconnaissance / target identification An attacker identifies an exposed or reachable SEDR Console deployment (versions prior to 4.13). Internet- or intranet-accessible management interfaces are the primary target. The attacker determines that the console accepts user-supplied input that is later rendered back into a page viewed by another user (for example, a search or filter field, a saved view, or a log/alert detail rendered in the UI). Because the exact input surface is not disclosed, the attacker would perform manual or automated input reflection testing against console pages to find where injected markup returns unencoded.

2. Triggering the flaw class The attacker crafts an input containing script content and arranges for it to be stored in, or reflected into, a page rendered by the SEDR Console. In a reflected scenario, the crafted input is delivered via a link that a privileged user is induced to open (UI:R). In a stored scenario, the attacker submits the payload through any console input that persists, and the script fires when a victim views the affected page. The low Privileges Required (PR:L) rating indicates the attacker needs some low-privileged access or submission capability on the console, not full administrative rights.

3. Payload / execution method The malicious script executes in the browser context of the victim user's authenticated SEDR Console session. At the vulnerability-class level, the script can read and manipulate the DOM visible to that session, issue authenticated requests on the user's behalf, and exfiltrate data reachable through the session. No specific payload or endpoint is claimed here because none is provided in the source data.

4. Post-exploitation impact Given Scope:C and low Confidentiality/Integrity impacts, the attacker could obtain console-restricted information and perform limited actions under the victim's identity. In the context of an EDR console, this could include visibility into endpoint and alert data and access to console functions normally limited to that user. Impact is bounded (C:L/I:L) and there is no Availability impact (A:N) in the CVSS vector.

Impact Assessment

CVSS 3.1 base score: 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

• Exploitability: Remote (AV:N), low complexity (AC:L), requires low privileges (PR:L) and user interaction (UI:R). This combination makes the flaw a credible phishing/redirection-style or low-privileged-operator threat rather than an unauthenticated wormable issue.
• Impact: Scope is Changed (S:C), meaning script execution can affect resources beyond the vulnerable component's security authority. Confidentiality and Integrity impacts are Low; Availability impact is None.
• Blast radius: The SEDR Console is an administrative security tool. Compromise of an authenticated console session could expose telemetry, endpoint data, and management functionality visible to that user. Because a single XSS can affect any user who views the crafted page/input, multiple console operators could be impacted from a single injection.
• EPSS: 0.00172 (approx. 0.17% probability of exploitation in the next 30 days), 6.1% percentile of exploited CVEs. This indicates low but non-zero predicted exploitation activity.
• CISA KEV: Not listed. No confirmed in-the-wild exploitation at time of writing.
• Business impact: An XSS in an EDR management console undermines trust in a security-control plane. Secondary effects may include credential/session theft, unauthorized console actions, and pivoting to other management integrations. The 5.4 rating reflects that user interaction and low privileges constrain, but do not eliminate, the risk.

Detection Guidance

Sigma Rule

title: Potential XSS Exploitation Attempt Against Symantec SEDR Console (CVE-2026-19810)
id: 7f3c2b1a-9d4e-4c8a-b6f2-2a1c9e5d8b30
status: experimental
description: Detects script-tag and event-handler patterns in requests/responses associated with the SEDR Console web interface, indicative of attempted XSS exploitation of CVE-2026-19810.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19810
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: symantec
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_uri:
    cs-uri-stem|contains:
      - '/sedr'
      - '/console'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - '<img'
      - 'svg/onload'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-User-Agent
falsepositives:
  - Security scanners and authorized penetration tests
  - Legitimate application input containing markup-like strings
level: medium
tags:
  - attack.t1059.007
  - cve.2026.19810

YARA Rule

rule CVE_2026_19810_SEDR_XSS_Indicators
{
    meta:
        description = "Detects common XSS payload indicators associated with attempted exploitation of Symantec SEDR Console CVE-2026-19810"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19810"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $xss1 = "<script" nocase ascii
        $xss2 = "</script>" nocase ascii
        $xss3 = "onerror=" nocase ascii
        $xss4 = "onload=" nocase ascii
        $xss5 = "javascript:" nocase ascii
        $xss6 = "document.cookie" nocase ascii
        $xss7 = "svg/onload" nocase ascii
        $sedr1 = "SEDR" ascii
        $sedr2 = "Symantec Endpoint Detection" ascii

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x213C or true) and
        (2 of ($xss*)) and (any of ($sedr*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19810 Potential XSS Exploitation in Symantec SEDR Console"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"<script"; nocase; http.uri; content:"SEDR"; nocase; sid:2026198101; rev:1; reference:cve,2026-19810; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19810; classtype:web-application-attack; metadata:service http;)

alert http any any -> any any (msg:"CVE-2026-19810 XSS Payload with Event Handler in SEDR Request"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"onerror="; nocase; http.request_body; content:"javascript:"; nocase; sid:2026198102; rev:1; reference:cve,2026-19810; classtype:web-application-attack; metadata:service http;)

Elastic Detection

sequence by source.ip
  [http where http.request.method in ("GET", "POST") and
       wildcard(http.request.uri.path, "*sedr*", "*console*") and
       (wildcard(http.request.uri.query, "*<script*", "*%3Cscript*", "*onerror=*", "*onload=*", "*javascript:*"))]
  [http where http.response.status_code in (200, 302) and
       wildcard(http.request.uri.path, "*sedr*", "*console*")]

Splunk SPL Query

index=web sourcetype=symantec:sedr OR sourcetype=access_combined
| eval uri_path = coalesce(uri_path, cs_uri_stem), uri_query = coalesce(uri_query, cs_uri_query)
| where like(uri_path, "%sedr%") OR like(uri_path, "%console%")
| search uri_query="*<script*" OR uri_query="*%3Cscript*" OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*javascript:*" OR uri_query="*document.cookie*"
| table _time, src_ip, clientip, uri_path, uri_query, status, user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="symantec,sedr,web,xss,">
  <rule id="2026198" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.*(<script|%3Cscript|onerror=|onload=|javascript:|document\.cookie).*</field>
    <description>CVE-2026-19810: Possible XSS exploitation attempt against Symantec SEDR Console</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_19810,xss_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict network access to the SEDR Console. Do not expose the console to the internet or to untrusted network segments; enforce access through a management VLAN or VPN with authenticated, least-privileged users.
• Apply a Web Application Firewall (WAF) with XSS-focused rule sets in front of the console where feasible; enable output-encoding and input-sanitization checks for console traffic.
• Enforce strict Content Security Policy (CSP) headers at any reverse proxy serving the console to reduce the impact of injected inline script.
• Set console session cookies with HttpOnly and Secure flags where configurable to limit script-based session theft.
• Monitor for and prohibit unauthorized/unknown input submissions to console-rendered fields.

2. Patch/upgrade steps

• The NVD description states the issue affects versions "prior to 4.13." Upgrade the SEDR Console to version 4.13 or later. Because no vendor advisory or patch identifier was available in tracked sources, verify the fix and the exact remediated build directly with Broadcom/Symantec before relying solely on the version boundary.
• After upgrading, re-test any previously identified input surfaces for reflected/stored script execution.

3. Long-term hardening

• Maintain an inventory of security-management consoles and enforce aggressive network segmentation for them.
• Adopt a routine patch-validation cadence for security tooling, since these consoles are high-value targets.
• Perform regular authenticated DAST/SAST testing against console input points and validate output encoding for all user-influenced data rendered in the UI.
• Centralize logging from console web servers and correlate with identity/session data to detect script-injection attempts early.

References

• NVD — CVE-2026-19810: https://nvd.nist.gov/vuln/detail/CVE-2026-19810
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Broadcom/Symantec Security Advisories (vendor security center — verify the specific SEDR 4.13 advisory): https://support.broadcom.com/
• CISA Known Exploited Vulnerabilities Catalog (verify whether CVE-2026-19810 is later added): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. CISA KEV status: NO. EPSS: 0.00172 (~0.17%), 6.1% percentile. No public PoC, exploit code, or Nuclei template available at time of writing.