CVE-2026-22896: Stored XSS via Interface Name in Network & Virtual Switch App
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code.
We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must first gain an administrator account. The reported attack path is remote exploitation after obtaining administrator-level access.
Which releases contain the fix?
Fixed versions are Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later, QTS 5.2.1.2930 build 20241025 and later, QuTS cloud c5.2.4.3041 build 20250211 and later, QuTS hero h5.1.8.2823 build 20240712 and later, and QuTS hero h5.2.1.2929 build 20241025 and later.