Read the docs
TI-2026-05045 Aliases CVE-2026-5754GHSA-f522-98m8-h7xc

Radware Alteon has a reflected XSS vulnerability

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RadwareAlteon vADC34.5.4.0—No fix listedCNA
  • Alteon vADC VendorRadware Affected 34.5.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5754
  2. 2026-10-03 Alias added: GHSA-f522-98m8-h7xc

References

Other 1

  • TI-2024-37411 Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to… CVSS 3.1CRITICAL 9.1
  • TI-2024-37410 Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to… CVSS 3.1CRITICAL 9.1
  • TI-2017-12731 Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable… CVSS 3.0MEDIUM 5.9
  • TI-2009-02193 The radware AppWall Web Application Firewall (WAF) 1.0.2.6, with Gateway 4.6.0.2, allows… CVSS 2.0HIGH 7.8
  • TI-2016-08288 Radware devices use the same value for the first two GCM nonces, which allows remote… CVSS 3.0MEDIUM 5.9
  • TI-2026-10950 Radware Cyber Controller HTML Report Generation HTML injection CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences