Talassoft CVE-2026-92085

Exploitation requires (1) a valid authenticated account in Talassoft Industrial Management Software with sufficient privilege to write into a persisted field (PR:L - not anonymous/unauthenticated), and (2) a separate victim user subsequently loading the web page that renders the stored, un-neutralized input (UI:R). The payload must survive server-side storage and be reflected back without output encoding during web page generation. Limiting factors: the attacker needs working credentials beforehand, the attack is not self-triggering (a human victim must view the affected page), and impact is bounded to the browser session context (C:L/I:L, no availability impact). The exact field or module accepting the injectable input is not specified in the advisory.

This is a moderate-severity stored XSS (CWE-79) with a CVSS 3.1 base score of 5.4. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity flaw, but exploitation requires an authenticated low-privileged account (PR:L) to store the payload and a victim to subsequently view the affected page (UI:R). The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the application's, but confidentiality and integrity impact are only Low and availability is unaffected. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, placing this firmly below actively-exploited critical issues. The dual PR:L + UI:R requirement meaningfully constrains real-world risk: an attacker already needs valid credentials to the application and must wait for or socially engineer a higher-value user into triggering the stored payload. This is a legitimate but second-tier priority - patch during normal maintenance for internet-facing or multi-user deployments, not an emergency. No signals conflict; the main gap is simply the absence of exploitation-probability data (EPSS/KEV/POC all unreported), so prioritization rests on CVSS and deployment context alone.

An attacker with a low-privileged authenticated account in Talassoft Industrial Management Software submits malicious JavaScript into a stored field (e.g., a record, comment, or form processed into a web page). When a higher-privileged operator or administrator later opens the page containing that record, the script executes in their browser session, enabling session-token theft or actions on their behalf. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim viewing the poisoned page (UI:R).