CVE-2026-2678: Multiple vulnerabilities in A3factura software

Published Feb 26, 2026

Updated

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura-app.wolterskluwer.es/#/incomes/customers' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Affected Software

2 affected components

Wolters Kluwer A3factura

wolterskluwer A3factura=4.111.2-rev.1

Remediation

Information

The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026.

Event History

Feb 26, 2026

CVE Published

via MITRE·12:17 PM

Data Sourced

via MITRE·12:17 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeaknessAffected Software

Oct 1, 58139

Event

via FIRST·03:33 PM

Frequently Asked Questions

What is the severity of CVE-2026-2678?

CVE-2026-2678 is considered a critical vulnerability due to its potential for reflected cross-site scripting (XSS) attacks.

How does CVE-2026-2678 affect the A3factura software?

CVE-2026-2678 affects the A3factura software by allowing attackers to execute arbitrary code in the victim's browser through malicious input.

What are the affected components in CVE-2026-2678?

The affected component in CVE-2026-2678 is the A3factura web platform, specifically in the 'name' parameter on the specified endpoint.

How do I fix CVE-2026-2678?

To fix CVE-2026-2678, sanitize and validate user input in the affected parameters to prevent XSS exploitation.

Can I mitigate CVE-2026-2678 without applying a patch?

Yes, mitigating CVE-2026-2678 can be achieved by implementing security headers and input validation measures, but patching is recommended for full protection.