CVE-2026-26723

CVE-2026-26723 is a Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, in Key Systems Inc Global Facilities Management Software version 20230721a. Published on 2026-02-20, it enables a remote attacker to execute arbitrary code through the function parameter. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, high confidentiality impact, low integrity impact, and no availability impact.

A remote attacker can exploit this vulnerability without authentication by crafting malicious input targeting the function parameter, typically delivered via a phishing link or malicious webpage that requires user interaction, such as clicking or viewing content. Successful exploitation executes arbitrary code in the victim's browser context, potentially leading to theft of sensitive session data, cookies, or other confidential information hosted by the application, as reflected in the high confidentiality impact and scope change.

The primary reference for this vulnerability is a GitHub repository containing vulnerability disclosures at https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26723, which may provide additional details on exploitation or remediation steps.