PT-2026-26038 · Unknown · Link Aggregation

Gabriele Quagliarella · Publicado 2026-03-18 · Atualizado 2026-03-18 · CVE-2026-22322

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions versions prior to 2026-22322

Description A stored cross-site scripting (XSS) issue exists in the Link Aggregation configuration interface. An unauthenticated remote attacker can create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’s browser, potentially enabling unauthorized interface manipulation. The session cookie is protected by the httpOnly flag, preventing session takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22322

Produtos afetados

Link Aggregation

Referências · 6

• https://twitter.com/cyberbivash/status/2034190308678738082 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22322 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034216960712425595 · Publicação no Twitter
• https://certvde.com/de/advisories/VDE-2025-104 · Nota
• https://twitter.com/CVEnew/status/2034365311164862774 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2034209841246351793 · Publicação no Twitter