CVE-2026-2680: Multiple vulnerabilities in A3factura software

Published Feb 26, 2026

Updated

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser.

Affected Software

2 affected components

Wolters Kluwer A3factura

wolterskluwer A3factura=4.111.2-rev.1

Remediation

Information

The fix has been deployed in production in version 4.114.0-rev.6, released on 17/02/2026.

Event History

Feb 26, 2026

CVE Published

via MITRE·12:18 PM

Data Sourced

via MITRE·12:18 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeaknessAffected Software

Oct 1, 58139

Event

via FIRST·08:00 PM

Frequently Asked Questions

What is the severity of CVE-2026-2680?

CVE-2026-2680 is classified as a high severity vulnerability due to the potential for arbitrary code execution.

How do I fix CVE-2026-2680?

To fix CVE-2026-2680, ensure that the A3factura software is updated to the latest version provided by Wolters Kluwer that patches the XSS vulnerabilities.

What type of vulnerability is CVE-2026-2680?

CVE-2026-2680 is a reflected cross-site scripting (XSS) vulnerability affecting the A3factura web platform.

Where is CVE-2026-2680 located in the A3factura software?

CVE-2026-2680 is found in the 'customerVATNumber' parameter on the a3factura-app.wolterskluwer.es/#/incomes/salesDeliveryNotes endpoint.

Who is affected by CVE-2026-2680?

Users of the A3factura software platform are at risk due to CVE-2026-2680, as it can allow attackers to execute malicious code.