CVE-2026-40464
A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
Public disclosure |
31-08-2026 |
|---|---|
Last updated |
31-08-2026 |
Vulnerability type |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVSS vector |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L |
CVSS score |
8.2 |
Description
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content.
Affected products and versions
NSP versions 22.3, 22.6, 22.9, 22.11, 23.4, 23.8, 23.11, 24.4, 24.8, 24.11, 25.4, 25.8 and 25.11.
Mitigation plan
Fixes have been provided in NSP 24.11-SP15, NSP 25.11-SP5, NSP 26.4 and later releases.