Verint Verba software contains a stored XSS vulnerability (CVE-2026-21730) allowing…
Verint Verba software contains a stored XSS vulnerability (CVE-2026-21730) allowing unauthenticated attackers to execute malicious code in administrator browsers via login logs.
CERT Polska coordinated the disclosure of CVE-2026-21730, a stored cross-site scripting vulnerability in Verint Verba software. The flaw exists in the login logging mechanism where unauthenticated attackers can inject malicious JavaScript payloads through the username field during failed authentication attempts. Due to insufficient input sanitization, these payloads are stored in application logs and subsequently executed when administrators access the log viewer interface.
The vulnerability requires no authentication and leverages the trust relationship between the logging system and administrative interfaces. When triggered, the malicious script executes in the security context of the administrator's browser session, potentially enabling session hijacking, credential theft, or privilege escalation. The vulnerability was responsibly disclosed by Jan Czerlunczakiewicz from STM Cyber and has been remediated in Verint Verba version 10.0.6.
Organizations running affected versions of Verint Verba should prioritize upgrading to version 10.0.6 or later. Administrators should also review historical login logs for suspicious username entries containing HTML or JavaScript syntax, as these may indicate exploitation attempts or compromised sessions.
Mentioned in this report
Detection guidance
Potential Stored XSS Payload in Login Username Parameter (CVE-2026-21730)
Detects HTTP requests to authentication endpoints where the username parameter contains HTML/JavaScript injection markers, consistent with exploitation of the Verint Verba stored XSS login-logging vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Stored XSS Payload in Login Username Parameter
id: 8c35cb71-94f6-5027-a482-d947244568c3
status: experimental
description: 'Detects HTTP requests (typically failed login attempts) where the username
field/parameter contains HTML or JavaScript injection syntax such as
<script>, onerror=, javascript: or event handler attributes. This matches
the exploitation pattern for CVE-2026-21730, a stored XSS in Verint Verba''s
login logging mechanism, where an unauthenticated attacker submits a
malicious username value that is later rendered unsanitized in the admin
log viewer.
'
references:
- CVE-2026-21730
author: Vorant
logsource:
category: webserver
detection:
selection_field:
cs-uri-query|contains:
- username=
- user=
- login=
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- onerror=
- onload=
- 'javascript:'
- <img
- <svg
- String.fromCharCode
condition: selection_field and selection_payload
falsepositives:
- Authorized penetration testing or vulnerability scanning against the login form
- Security researchers validating the CVE-2026-21730 patch
level: high
tags:
- attack.T1059.007
- attack.initial_access
- cve.2026-21730
Login Attempt with HTML/JS Encoded Username in POST Body
Detects POST requests to authentication/login endpoints whose request body contains encoded or raw script injection syntax in the username field, indicating an attempt to exploit stored XSS via unauthenticated login logging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Login POST Request Body Containing Script Injection in Username Field
id: 63c2f344-5244-592e-b6bb-d8cfc0d34af2
status: experimental
description: 'Detects HTTP POST requests to authentication endpoints where the captured
request body (as logged by a proxy, WAF, or reverse proxy) contains
username values with embedded script tags, event handler attributes, or
URL-encoded angle brackets. This behaviour matches unauthenticated
exploitation attempts against the Verint Verba stored XSS login logging
vulnerability (CVE-2026-21730), where the payload is stored and later
executed in an administrator''s browser via the log viewer.
'
references:
- CVE-2026-21730
author: Vorant
logsource:
category: proxy
detection:
selection_method:
cs-method: POST
selection_uri:
cs-uri-stem|contains:
- /login
- /auth
- /signin
selection_payload:
c-uri|contains:
- <script
- '%3Cscript'
- onerror=
- onload=
- 'javascript:'
- '<script'
condition: selection_method and selection_uri and selection_payload
falsepositives:
- Automated web application security scanners testing for XSS on the login form
- QA/regression test suites submitting special characters as part of input validation
testing
level: medium
tags:
- attack.T1059.007
- attack.T1189
- cve.2026-21730
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-21730
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free