EUVD-2026-68373
GHSA-w5wj-3hwj-55cw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS requiring authenticated workflow write access (PR:L) and victim interaction (UI:R); scope changes to victim browser (S:C) with limited confidentiality and integrity impact and no availability effect.
Primary rating from Vendor (Nokia).
CVSS VectorVendor: Nokia
Lifecycle Timeline
3DescriptionCVE.org
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.
AnalysisAI
Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid NSP account with at least low-privilege access to the workflow application - confirmed by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score is consistent with the threat model: authentication is required of the attacker (PR:L), the victim must actively view the injected content (UI:R), and the direct impact is limited to partial confidentiality and integrity (C:L/I:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch per the Nokia security advisory at https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40464/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today