Is there a patch available for CVE-2026-26352?

Yes, a patch is available for CVE-2026-26352. Update the affected software to the latest version immediately.

Express CVE-2026-26352

Q: What is the CVSS score of CVE-2026-26352?

CVE-2026-26352 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17126 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 VulnCheck

GHSA-7455-x3qx-74xc

XSS Express

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 17:15 euvd

EUVD-2026-17126

Analysis Generated

Mar 30, 2026 - 17:15 vuln.today

Patch released

Mar 30, 2026 - 17:15 nvd

Patch available

CVE Published

Mar 30, 2026 - 16:49 nvd

MEDIUM 5.1

DescriptionCVE.org

Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPN_IP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes when the affected page is viewed by other users.

AnalysisAI

Stored cross-site scripting in Smoothwall Express prior to version 3.1 Update 13 allows authenticated attackers to inject arbitrary JavaScript through the VPN_IP parameter in /cgi-bin/vpnmain.cgi, which executes when other users view affected VPN configuration pages. The vulnerability requires user interaction (page view) and authenticated access, limiting immediate risk but enabling persistent session hijacking or credential theft against administrative users. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exists in Smoothwall Express (CPE: cpe:2.3:a:smoothwall:express:*:*:*:*:*:*:*:*), a network gateway and firewall appliance platform. The root cause is improper input validation and output encoding in the /cgi-bin/vpnmain.cgi CGI script, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The VPN_IP parameter accepts and stores user-supplied data without sufficient sanitization, allowing injection of malicious JavaScript payloads. When the VPN configuration page is rendered for other authenticated users, the injected script executes in their browser context with the privileges of their session, enabling session-based attacks.

RemediationAI

Vendor-released patch: Smoothwall Express 3.1 Update 13 or later. Administrators should immediately upgrade affected Smoothwall Express installations to version 3.1 Update 13 to remediate the stored XSS vulnerability in the VPN configuration subsystem. As an interim control prior to patching, restrict access to the /cgi-bin/vpnmain.cgi endpoint to trusted administrative IP ranges or VPN networks, and audit VPN configuration pages for any suspicious JavaScript or encoded payloads already injected into the VPN_IP parameter. For additional details, consult the vendor advisory at https://community.smoothwall.org/forum/viewtopic.php?t=45095.