Cybozu Garoon CVE-2026-57279

Q: What is the CVSS score of CVE-2026-57279?

CVE-2026-57279 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55082 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 jpcert

GHSA-52jw-w52q-hj2v

XSS Cybozu Garoon

6.0

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

PR:L reflects required low-privilege account; C:L added over vendor's C:N because XSS in victim session enables session token theft.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 08:22 NVD

6.8 (MEDIUM) 6.0 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 08:01 vuln.today

DescriptionCVE.org

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.

AnalysisAI

Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.

Technical ContextAI

Cybozu Garoon is a Japanese enterprise groupware and intranet platform (CPE: cpe:2.3:a:cybozu,_inc:cybozu_garoon:*:*:*:*:*:*:*:*) used widely across Japanese corporate environments. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), indicating the application fails to sanitize or encode attacker-controlled input before reflecting or storing it in HTML contexts served to other users. The CVSS scope change (S:C) and PR:L metric together suggest a stored or DOM-based variant where a low-privilege user can plant a payload that executes in the session context of other, potentially higher-privilege, users.

RemediationAI

Consult the Cybozu support advisory at https://kb.cybozu.support/article/39182/ for the official patch - no exact fix version is confirmed in the available data, so a specific upgrade target cannot be cited here. Organizations should apply the vendor-released update as soon as it is confirmed from that advisory. As a compensating control pending patching, restrict Garoon access to trusted internal networks and authenticated corporate accounts only, reducing the attacker pool that could inject payloads. Administrators should audit user-generated content areas (bulletins, comments, form fields) for unexpected script tags or encoded payloads. Note that restricting user-generated content features may impact legitimate collaboration workflows. The JPCERT/CC advisory at https://jvn.jp/en/jp/JVN72334274/ may include additional vendor guidance or workarounds.