CVE-2026-22675: OCS Inventory NG Server Stored XSS via User-Agent
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block access to the /ocsinventory endpoint from untrusted networks/hosts (or restrict it to authorized clients) to prevent unauthenticated attackers from submitting malicious User-Agent headers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22675?
CVE-2026-22675 has a moderate severity rating due to its potential for stored XSS attacks.
How do I fix CVE-2026-22675?
To fix CVE-2026-22675, upgrade to OCS Inventory NG Server version 2.12.4 or later.
Who is affected by CVE-2026-22675?
CVE-2026-22675 affects users of OCS Inventory NG Server versions 2.12.3 and prior.
What type of vulnerability is CVE-2026-22675?
CVE-2026-22675 is a stored cross-site scripting (XSS) vulnerability.
Can attackers exploit CVE-2026-22675 without authentication?
Yes, attackers can exploit CVE-2026-22675 without requiring authentication.