Verint Verba CVE-2026-21730

Exploitation of the injection phase requires only network access to the Verba login page - no authentication, no special account, and no non-default configuration. The login logging feature is presumed active by default, as it is a core auditing function. However, actual payload execution is strictly conditional on an administrator opening the web-based log viewer after the malicious log entry has been written; without this admin interaction (UI:P per CVSS 4.0), the stored payload remains dormant and causes no harm. Exploitation is therefore not automatable per SSVC - the attacker cannot force or time admin access. Exploitation is also bounded to Verba versions below 10.0.6 and to environments where the web log viewer is accessible to admins (rather than log review occurring via exported files or SIEM).

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N accurately captures the attack profile: exploitation is trivially easy (no authentication, no complex preconditions), but actual harm is gated on an administrator passively viewing logs (UI:P). The absence of direct vulnerable-system impact (VC/VI/VA all N) reflects that Verba itself is not directly compromised - only the admin's browser session is affected. SSVC corroborates this framing: exploitation status is none, automatable is no (human interaction creates a non-automatable dependency chain), and technical impact is partial. EPSS at 0.17% (38th percentile) suggests low current exploitation interest, consistent with the absence of a public proof-of-concept and no CISA KEV listing. Despite a modest numerical score, the real-world risk in administrative environments is meaningful: a successful attack can harvest admin session tokens or perform privileged actions on behalf of the administrator, which could enable deeper compromise. The risk is not inflated by CVSS - it reflects a genuine but interaction-dependent threat.

An unauthenticated attacker submits a failed login to the Verba web interface using a username containing a JavaScript payload designed to exfiltrate the administrator's session cookie to an attacker-controlled endpoint. The payload is written verbatim to the application's audit log. When an administrator later opens the log viewer to review failed login events, the malicious script executes in the admin's browser session, silently transmitting the session token and enabling the attacker to impersonate the administrator without further interaction.