PT-2026-26038 · Unknown · Link Aggregation

Gabriele Quagliarella · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-22322

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions versions prior to 2026-22322

Description A stored cross-site scripting (XSS) issue exists in the Link Aggregation configuration interface. An unauthenticated remote attacker can create a trunk entry containing malicious HTML/JavaScript code. When the affected page is viewed, the injected script executes in the context of the victim’s browser, potentially enabling unauthorized interface manipulation. The session cookie is protected by the httpOnly flag, preventing session takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22322

Affected Products

Link Aggregation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22322 · Security Note
• https://twitter.com/cyberbivash/status/2034190308678738082 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034216960712425595 · Twitter Post
• https://certvde.com/de/advisories/VDE-2025-104 · Note
• https://twitter.com/CVEnew/status/2034365311164862774 · Twitter Post
• https://twitter.com/RedPacketSec/status/2034209841246351793 · Twitter Post