What is the CVSS score of EUVD-2026-42018?

EUVD-2026-42018 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Access Control System GKS EUVD-2026-42018

| CVE-2026-8309 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-07 TR-CERT

GHSA-8g9p-mgr6-f26j

XSS Access Control System Gks Armiya Information Technologies Ltd Co

5.4

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by authenticated web app context; UI:R required for reflected delivery; S:C applies as script executes in victim browser scope; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 08:07 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS.

This issue affects Access Control System (GKS): before Version 2.

AnalysisAI

Reflected cross-site scripting in Armiya Information Technologies' Access Control System (GKS) before Version 2 allows authenticated remote attackers to inject malicious scripts into web responses. The vulnerability (CWE-79) results from improper neutralization of user-supplied input during web page generation, with scope change (S:C) indicating execution context escapes to the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) reflects a classic reflected XSS pattern: user-controlled input is echoed back into a rendered HTML response without adequate encoding or sanitization, enabling script injection. The affected product is a web-based physical access control management application by Turkish vendor Armiya Information Technologies (CPE: cpe:2.3:a:armiya_information_technologies_ltd._co.:access_control_system_(gks):*:*:*:*:*:*:*:*). The CVSS S:C (scope changed) indicator confirms the injected script executes in the victim's browser security context rather than the server's, a hallmark of reflected XSS. All versions before Version 2 are affected according to the advisory.

RemediationAI

Upgrade to Access Control System (GKS) Version 2 or later, which is the vendor-confirmed fix boundary per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502. Patch available per vendor advisory; an exact patched build version beyond 'Version 2' was not independently confirmed from available data. As a compensating control prior to patching, consider restricting access to the GKS web interface to trusted internal networks or VPN segments to reduce exposure of the reflected endpoint to untrusted users. Additionally, deploying a web application firewall (WAF) rule to filter common XSS payloads on responses from the GKS application can reduce risk, though WAF bypass techniques exist and this should not replace patching.