SB2026110987 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Group Office

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110987

SB2026110987 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Group Office

Published: November 9, 2026

Security Bulletin ID SB2026110987
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: CVE-2026-63010)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to take over another user's Group Office account, including an administrator's account.

The vulnerability exists due to unsanitized manual reminder content being rendered as HTML in the notification panel when the victim's browser automatically polls for reminders. A low-privileged authenticated attacker can create and assign a malicious reminder to any user, causing stored JavaScript to execute in that user's session without victim interaction.


Remediation

Install update from vendor's website.

References