# AdaptiveGRC software contains a stored XSS vulnerability (CVE-2026-4313) allowing…

Published: 2026-04-24 · Severity: high
Canonical: https://vorant.io/reports/5007684d-c790-4a8a-8b24-822b4d26d38e/adaptivegrc-software-contains-a-stored-xss-vulnerability-cve-2026-4313-allowing

> AdaptiveGRC software contains a stored XSS vulnerability (CVE-2026-4313) allowing authenticated attackers to steal admin tokens and escalate privileges.

CERT Polska coordinated the disclosure of CVE-2026-4313, a stored cross-site scripting vulnerability in AdaptiveGRC software. The flaw exists in text-type fields across forms where authenticated attackers can inject malicious JavaScript by manipulating HTTP POST request values. Due to improper server-side validation, the injected code executes in victim browsers when they view the affected fields.

The most critical impact is the potential theft of administrator authentication tokens, enabling attackers to perform arbitrary administrative actions and potentially achieve full system compromise. All AdaptiveGRC versions released before December 2025 are affected by this vulnerability.

The vulnerability was responsibly disclosed by Antoni Kwietniewski from mBank and coordinated through CERT Polska's vulnerability disclosure process. Organizations using AdaptiveGRC should upgrade to versions released after December 2025 to remediate this issue.

## Mentioned in this report

- Vulnerabilities: CVE-2026-4313

## Detection guidance (public sample)

### Possible Stored XSS Payload Injection via HTTP POST (AdaptiveGRC CVE-2026-4313)

ATT&CK: T1059.007

Detects HTTP POST requests containing inline JavaScript/script tags submitted to AdaptiveGRC form fields, indicative of stored XSS payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Stored XSS Payload Injection via HTTP POST
id: a8dce28a-64a3-539e-b7c2-12bdd558b5e9
status: experimental
description: Detects HTTP POST requests containing script tags or inline JavaScript
  event handlers in request body/query fields, consistent with stored XSS payload
  injection such as CVE-2026-4313 in AdaptiveGRC.
references:
- CVE-2026-4313
logsource:
  category: webserver
  product: windows
detection:
  selection:
    cs-method: POST
  payload_indicators:
    cs-uri-query|contains:
    - <script
    - onerror=
    - onload=
    - 'javascript:'
    - document.cookie
  condition: selection and payload_indicators
falsepositives:
- Legitimate rich-text or HTML content submitted by trusted administrators
- Security scanners or penetration testers actively testing the application
level: medium
tags:
- attack.t1059.007
- attack.execution
author: Vorant
```

### Suspicious Access Token / Cookie Exfiltration Pattern in Web Requests

ATT&CK: T1185

Detects outbound HTTP requests containing session cookie or authentication token values in URI/query parameters, potentially indicating browser session hijacking following stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Session Token Exfiltration via HTTP Request
id: f6bbd9fd-807d-5591-91d9-a3eb6abaa0e3
status: experimental
description: Detects outbound HTTP GET/POST requests where the query string or body
  appears to contain session cookie or token values, consistent with exfiltration
  of stolen administrator session tokens after a stored XSS attack (e.g. CVE-2026-4313).
references:
- CVE-2026-4313
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - document.cookie
    - sessionid=
    - auth_token=
    - PHPSESSID=
  condition: selection
falsepositives:
- Legitimate application debugging or analytics scripts that echo cookie values for
  troubleshooting
- Internal monitoring tools that log session identifiers for support purposes
level: medium
tags:
- attack.t1185
- attack.collection
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4313

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5007684d-c790-4a8a-8b24-822b4d26d38e/adaptivegrc-software-contains-a-stored-xss-vulnerability-cve-2026-4313-allowing.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup