EUVD-2026-38198
GHSA-h822-984p-4x2q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication and victim report-viewing (UI:R) are required; impact is limited to low integrity injection with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The manipulation leads to HTML injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
HTML injection in Radware Cyber Controller's HTML Report Generation component allows authenticated remote attackers to embed arbitrary HTML tags - including script-related content - into generated reports, enabling potential cross-site scripting scenarios targeting users who view those reports. All 10.x releases through 10.11.0 are confirmed affected per ENISA EUVD-2026-38198. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P); the vendor was notified but did not respond, leaving no vendor-released patch available at time of analysis.
Technical ContextAI
Radware Cyber Controller is a centralized network security and application delivery management platform. The vulnerability resides in its HTML Report Generation subsystem, where user-controllable input is embedded into HTML output without adequate sanitization or encoding. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) identifies the root cause class: the application fails to neutralize HTML tags before rendering them in a browser context, allowing injected content to be interpreted as markup rather than data. The affected product is identified by CPE cpe:2.3:a:radware:cyber_controller:*:*:*:*:*:*:*:*, covering all versions in the 10.x branch. The tags associated with this entry (XSS, Cyber Controller) indicate that the injected HTML can include script-related constructs capable of executing in a victim's browser session.
RemediationAI
No vendor-released patch has been identified at time of analysis - Radware did not respond to coordinated disclosure, and no fixed version is referenced in any available source. Organizations should treat all Cyber Controller 10.x deployments through 10.11.0 as unpatched and apply the following compensating controls: restrict the HTML Report Generation feature to the minimum number of trusted accounts necessary, reducing the pool of users who could inject malicious content (trade-off: limits reporting workflows); configure report distribution so HTML output is converted to PDF before sharing, preventing injected script content from executing in recipients' browsers (trade-off: may reduce report interactivity); and audit existing generated HTML reports for unexpected tags or script content. Monitor Radware's security advisories page for an eventual patch release and contact Radware support directly to request an emergency fix given the public exploit disclosure. Reference VulDB 372606 (https://vuldb.com/vuln/372606) for ongoing disclosure updates.
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today