Content Navigator CVE-2026-1243

The CVSS 5.4 (medium severity) reflects the moderate real-world risk posed by this vulnerability. The attack vector is network-accessible (AV:N) and the complexity is low (AC:L), meaning exploitation technique is straightforward once an attacker gains authenticated access. However, two factors significantly constrain exploitation: (1) Privilege Requirement (PR:L) means only authenticated users can inject the payload, limiting the attacker population to insiders, compromised accounts, or users tricked into accounts; (2) User Interaction (UI:R) requires a victim to click or interact with the malicious payload, reducing automatable exploitation. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact, meaning credential disclosure or session manipulation is possible but not system-wide compromise. The scope change (S:C) indicates potential impact beyond the vulnerable component. The absence of active exploitation (no KEV status confirmed, no POC identified) and low-to-medium CVSS suggest this is not a critical priority for rapid response, though it merits prompt patching in environments with strict insider-threat controls or high-risk user populations. Organizations should apply patches within normal maintenance windows rather than emergency response timelines.

An insider or social-engineering victim with authenticated Content Navigator access crafts a malicious JavaScript payload and embeds it into a persistent field (such as a document annotation, user profile field, or search filter) that other users interact with. When a targeted user opens the document or navigates to the compromised content in the Web UI, the JavaScript executes in their authenticated session, silently capturing their session tokens, login credentials, or triggering actions on their behalf (e.g., sharing sensitive documents). The attacker then uses the stolen credentials or session to access restricted content or modify documents. Because user interaction is required, the attack is most effective when combined with social engineering (e.g., phishing that directs the victim to 'review' a specific document).