Nokia NSP CVE-2026-40464

Exploitation requires the attacker to hold a valid NSP account with at least low-privilege access to the workflow application - confirmed by PR:L in the CVSS vector. A second authenticated NSP user (the victim) must then actively view the page rendering the malicious workflow content, confirmed by UI:R. The attack is not automatable (SSVC: automatable=no), ruling out mass scanning scenarios. Exploitation is further constrained by the need for a victim with sufficient privileges to make the session hijacking meaningful; the attack provides no value against equally low-privileged victims. No non-default configuration is required beyond normal workflow application availability. The primary limiting factors for defenders are the dual-user authentication requirement and the human-interaction dependency, both of which significantly reduce realistic exploitation risk beyond what the scope-changed CVSS metrics alone suggest.

The CVSS 5.4 Medium score is consistent with the threat model: authentication is required of the attacker (PR:L), the victim must actively view the injected content (UI:R), and the direct impact is limited to partial confidentiality and integrity (C:L/I:L). EPSS at 0.14% (3rd percentile) indicates very low community-observed exploitation probability, and SSVC rates exploitation as none with automatable set to no - meaning opportunistic mass scanning is not a viable threat vector. The scope change (S:C) is the most operationally significant signal: successful XSS executes in the victim's browser, enabling session token exfiltration, credential harvesting, or unauthorized actions on behalf of privileged NSP operators, effects that the partial C/I scores understate in high-privilege environments. No CISA KEV listing and no public POC exist at time of analysis. Overall, this is a well-characterized medium-severity issue for Nokia NSP operators - the dual authentication barrier and human-interaction dependency keep real-world risk manageable, but the potential to hijack administrator sessions warrants prompt patching in any production NSP deployment.

An authenticated attacker holding a low-privilege NSP workflow application account submits a crafted workflow entry embedding a JavaScript payload in an inadequately sanitized input field. When a higher-privileged NSP operator or administrator subsequently opens and views the malicious workflow in their browser, the script executes within their authenticated session, potentially exfiltrating their session token or performing privileged NSP management actions on the attacker's behalf. No public POC exists, but the attack primitive is a well-understood stored XSS pattern requiring no specialized tooling.