What is the CVSS score of CVE-2026-26723?

CVE-2026-26723 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Global Facilities Management Software are affected by CVE-2026-26723?

Global Facilities Management Software versions up to 20230721a contain a high-severity cross-site scripting vulnerability that could allow attackers to compromise user sessions and steal sensitive…

Is there a public PoC exploit available for CVE-2026-26723?

Yes, a public proof-of-concept exploit is available for CVE-2026-26723. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26723?

Within 24 hours: Inventory all instances of Global Facilities Management Software and identify affected versions; restrict network access to the application where possible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block XSS payloads; implement input validation and output encoding at the application layer; conduct user awareness brief on phishing risks. Within 30 days: Contact vendor for patch timeline; evaluate migration to alternative solutions if patch unavailable; perform security audit of all user accounts for unauthorized access.

Global Facilities Management Software CVE-2026-26723

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 cve@mitre.org

XSS Global Facilities Management Software

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 26, 2026 - 17:55 vuln.today

Public exploit code

CVE Published

Feb 20, 2026 - 17:25 nvd

HIGH 8.2

DescriptionCVE.org

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.

AnalysisAI

Global Facilities Management Software versions up to 20230721a is affected by cross-site scripting (xss) (CVSS 8.2).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the function component. Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.