CVE-2026-18516
9.6CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-116
Impact
Remote unauthenticated attackers can execute arbitrary JavaScript in the context of an administrator's session via stored XSS when logs are viewed. This requires an admin to view the compromised Audit Logs and can lead to full application takeover.
Root cause
Crafty Controller fails to sanitize and properly escape HTTP headers stored and rendered within the Audit Logs component.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Crafty Controller to the latest patched release per the vendor advisory. If patching must wait, restrict access to the web interface or avoid viewing the Audit Logs interface.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection