What is the CVSS score of CVE-2026-26724?

CVE-2026-26724 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-26724?

Yes, a public proof-of-concept exploit is available for CVE-2026-26724. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-26724?

Within 24 hours: Inventory all instances of Global Facilities Management Software and identify version numbers; restrict network access to the application to trusted internal networks only. Within 7 days: Implement WAF rules to block XSS payloads; disable any non-critical user-facing features that accept user input; enforce mandatory password resets for all users with administrative or sensitive access. Within 30 days: Monitor vendor advisories for patch availability; conduct security assessment of alternative facilities management solutions; develop migration plan if patch is not released within 60 days.

Global Facilities Management Software CVE-2026-26724

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 cve@mitre.org

XSS Global Facilities Management Software Keystorage

7.6

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to Global Facilities Management Software
Exploit

Craft malicious XSS payload in selectgroup/gn parameters
Execution

Submit to /?Function=Groups endpoint
Impact

Execute arbitrary code in victim browser context

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authenticated user account required. XSS payload injection via selectgroup or gn parameters on /?Function=Groups endpoint. Victim user must click/view the malicious link (UI interaction required).
Impact	CVSS 7.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Global Facilities Management Software versions up to 20230721a is affected by cross-site scripting (xss) (CVSS 7.6).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the selectgroup and gn component. Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the selectgroup and gn parameters on the /?Function=Groups endpoint.

Know when Global Facilities Management Software gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Feb 26, 2026 - 23:16 vuln.today

Public exploit code

CVE Published

Feb 20, 2026 - 17:25 nvd

HIGH 7.6

DescriptionCVE.org

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the selectgroup and gn parameters on the /?Function=Groups endpoint.

Executive ViewAI

Why It Matters

A high-severity cross-site scripting vulnerability in Global Facilities Management Software versions up to 20230721a poses a direct risk to user account compromise and data theft across our facilities management operations. With public exploits available and no vendor patch currently available, immediate mitigation is required to protect user credentials and operational data from malicious actors.

Business Impact: High

Compensating Controls

Deploy Web Application Firewall (WAF) with XSS filtering rules; implement network segmentation to restrict application access to authorized personnel only; disable or restrict input fields accepting user-generated content; enforce Content Security Policy (CSP) headers; enable enhanced logging and monitoring for suspicious activity; require multi-factor authentication for all application users; consider temporary operational workarounds to reduce application usage until patch is available.

Threat Intelligence Overview

EPSS Score

0.1%

Top 81% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.