CVE-2026-40126CWE-79cross-site-scripting

CVE-2026-40126

published August 17, 2026

CVSS
4.8
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server.

This issue was fixed in OutSystems Service Center version 11.41.2

The record
Technical detail
CVSS
4.8 · NONE
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00627 · 49.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-17T16:18Z
References (3)
https://cert.pl/en/posts/2026/08/CVE-2026-40126/ · [email protected]https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6669/ · [email protected]https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime · [email protected]
EPSS history
Timeline
  • 17 AUG 12:03Z
    DOM-based Cross-Site Scripting in OutSystems Service Center
    cvelistv5