Symantec SiteMinder
CVE-2026-3862
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:M/U:Green
PR:H reflects the requirement for attacker to hold admin privileges; S:C applied because XSS executes in victim's browser security context, not the vulnerable server.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page.
AnalysisAI
Reflected or stored cross-site scripting (XSS) in Broadcom Symantec SiteMinder allows a high-privileged attacker to inject malicious script content into application pages that is returned unaltered to victims who actively interact with the affected resource. The vulnerability requires PR:H and UI:A per the CVSS 4.0 vector, limiting real-world impact to scenarios where a privileged user can submit crafted data and a second user is socially engineered or passively exposed to the poisoned page. With an EPSS score of 0.04% (13th percentile) and no confirmed active exploitation or public proof-of-concept, this vulnerability represents a low-urgency but valid hardening target in enterprise SiteMinder deployments.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied data before it is embedded in a dynamic HTML response. In SiteMinder's context, this means an input field accepted by the application is echoed into the rendered page without stripping or encoding HTML-significant characters such as angle brackets or script tags. Symantec SiteMinder (CPE: cpe:2.3:a:broadcom:symantec_siteminder) is a mature enterprise web access management and single sign-on (SSO) platform from Broadcom that sits in front of protected web applications, making XSS flaws in its administrative or federation interfaces particularly sensitive since the platform itself controls authentication and session management for downstream resources. The CPE data confirms at least version 12.9 as affected, with the wildcard CPE suggesting broader version impact.
RemediationAI
Consult the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37176 for the vendor-confirmed patch or fixed release version; no specific fixed version number is derivable from the available input data. If patching is delayed, restrict access to SiteMinder administrative interfaces to trusted internal network segments or VPN-only access, reducing the attack surface by limiting who can submit attacker-controlled data into the application. Additionally, enforce strict Content Security Policy (CSP) headers on SiteMinder-served pages to reduce the impact of any XSS execution, though this is a mitigation, not a fix, and CSP bypass techniques exist. Audit and limit the number of accounts holding high-privileged access to SiteMinder administrative functions, as the vulnerability requires PR:H to exploit. VulDB entry https://vuldb.com/?id.349962 may also contain additional remediation detail.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today