CVE-2026-2679: Multiple vulnerabilities in A3factura software

Published Feb 26, 2026

Updated

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolterskluwer.es/#/incomes/salesInvoices' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Affected Software

2 affected components

Wolters Kluwer A3factura

wolterskluwer A3factura=4.111.2-rev.1

Remediation

Information

The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026.

Event History

Feb 26, 2026

CVE Published

via MITRE·12:18 PM

Data Sourced

via MITRE·12:18 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeaknessAffected Software

Oct 1, 58139

Event

via FIRST·03:17 PM

Frequently Asked Questions

What is the severity of CVE-2026-2679?

CVE-2026-2679 is classified as a high severity vulnerability due to its potential to allow attackers to execute arbitrary code in users' browsers.

How do I fix CVE-2026-2679?

To fix CVE-2026-2679, update to the latest secure version of A3factura software provided by Wolters Kluwer.

What impact does CVE-2026-2679 have on users?

CVE-2026-2679 can lead to unauthorized execution of scripts in the victim's browser, compromising user data and privacy.

Is CVE-2026-2679 exploitable without authentication?

Yes, CVE-2026-2679 can be exploited without authentication, allowing an attacker to manipulate web requests easily.

What are the symptoms of an attack exploiting CVE-2026-2679?

Symptoms of an attack exploiting CVE-2026-2679 may include unexpected redirections, altered web pages, or unauthorized actions performed on behalf of the user.