CVE-2026-15639CWE-79cross-site-scripting

CVE-2026-15639

published September 16, 2026

CVSS
9.3
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-16T04:17Z
References (1)
https://delinea.com/security-advisories · 1443cd92-d354-46d2-9290-d812316ca43a
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 15 SEP 23:21Z
    Reflected Cross-Site Scripting
    cvelistv5