CVE-2026-22322CWE-79

Stored Cross‑Site Scripting in Link Aggregation Name Handling

High · published March 18, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’s browser, enabling unauthorized actions such as interface manipulation. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-18T07:34Z
EPSS history
Timeline
  • 18 MAR 07:34Z
    Stored Cross‑Site Scripting in Link Aggregation Name Handling
    cvelistv5