Omega-PSIR software patched CVE-2026-1434, a reflected XSS vulnerability in the lang…
Omega-PSIR software patched CVE-2026-1434, a reflected XSS vulnerability in the lang parameter allowing arbitrary JavaScript execution via crafted URLs.
CERT Polska coordinated disclosure of CVE-2026-1434, a reflected cross-site scripting vulnerability in Omega-PSIR software. The flaw exists in the lang parameter and allows an attacker to craft malicious URLs that execute arbitrary JavaScript in a victim's browser when opened. The vulnerability was responsibly reported by security researcher Łukasz Rybak.
The vendor addressed the issue in Omega-PSIR version 4.6.7. Organizations running earlier versions should upgrade immediately to mitigate the risk of phishing campaigns or credential theft via social engineering attacks leveraging the XSS vector.
This disclosure follows CERT Polska's coordinated vulnerability disclosure process, demonstrating effective collaboration between security researchers, CERT teams, and vendors to remediate security flaws before public exploitation.
Mentioned in this report
Detection guidance
Possible Reflected XSS Attempt via lang Parameter
Detects HTTP requests containing script injection patterns in the lang parameter, consistent with exploitation attempts of reflected XSS vulnerabilities like CVE-2026-1434 delivered via phishing links. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Reflected XSS Attempt via lang Parameter
id: dff612ef-b4ea-5d38-93f2-7927086b8ec1
status: experimental
description: Detects HTTP requests where the lang URL parameter contains script tags,
javascript URI schemes, or event handler injection patterns, indicative of reflected
XSS exploitation attempts such as CVE-2026-1434 in Omega-PSIR, often delivered via
crafted phishing links.
references:
- CVE-2026-1434
logsource:
category: proxy
product: null
detection:
selection:
cs-uri-query|contains:
- lang=<script
- lang=%3Cscript
- 'lang=javascript:'
- lang=%22%3E%3Cscript
- lang=onerror=
- lang=onload=
filter:
cs-uri-query|contains:
- lang=en
- lang=pl
- lang=de
- lang=fr
condition: selection and not filter
fields:
- c-ip
- cs-uri-query
- cs-host
- cs-user-agent
falsepositives:
- Security scanning tools testing for XSS vulnerabilities on internal assets
- Automated vulnerability assessment scans against the Omega-PSIR application
level: medium
tags:
- attack.t1566.002
- attack.initial_access
- cve.2026-1434
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-1434
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free