OCS Inventory NG Server Stored XSS via User-Agent
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OCS Inventory | OCS Inventory NG Server | up to 2.12.3 | — | Patch available | CNA |
- OCS Inventory NG Server VendorOCS Inventory Affected up to 2.12.3 Fixed in — Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ocsinventory-ng:ocs_inventory_server:*:*:*:*:*:*:*:* | up to 2.12.3 | Vulnerable | OCS Inventory NG |
- cpe:2.3:a:ocsinventory-ng:ocs_inventory_server:*:*:*:*:*:*:*:* Versions up to 2.12.3 Vulnerable ·OCS Inventory NG
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22675
- 2026-10-03 Alias added: GHSA-xwcw-3qx7-8hxm
References
More OCS Inventory NG Ocs Inventory Server vulnerabilities
- TI-2018-10678 Unrestricted file upload (with remote code execution) in… CVSS 3.0HIGH 8.8
Sources
- CVE-2026-22675 · CVE Program
- CVE-2026-22675 · NVD
- FIRST EPSS
- GHSA-xwcw-3qx7-8hxm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences