# Verint Verba software contains a stored XSS vulnerability (CVE-2026-21730) allowing…

Published: 2026-05-14 · Severity: high
Canonical: https://vorant.io/reports/e039ea98-5982-4f23-8514-c6463bd393fa/verint-verba-software-contains-a-stored-xss-vulnerability-cve-2026-21730

> Verint Verba software contains a stored XSS vulnerability (CVE-2026-21730) allowing unauthenticated attackers to execute malicious code in administrator browsers via login logs.

CERT Polska coordinated the disclosure of CVE-2026-21730, a stored cross-site scripting vulnerability in Verint Verba software. The flaw exists in the login logging mechanism where unauthenticated attackers can inject malicious JavaScript payloads through the username field during failed authentication attempts. Due to insufficient input sanitization, these payloads are stored in application logs and subsequently executed when administrators access the log viewer interface.

The vulnerability requires no authentication and leverages the trust relationship between the logging system and administrative interfaces. When triggered, the malicious script executes in the security context of the administrator's browser session, potentially enabling session hijacking, credential theft, or privilege escalation. The vulnerability was responsibly disclosed by Jan Czerlunczakiewicz from STM Cyber and has been remediated in Verint Verba version 10.0.6.

Organizations running affected versions of Verint Verba should prioritize upgrading to version 10.0.6 or later. Administrators should also review historical login logs for suspicious username entries containing HTML or JavaScript syntax, as these may indicate exploitation attempts or compromised sessions.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21730

## Detection guidance (public sample)

### Potential Stored XSS Payload in Login Username Parameter (CVE-2026-21730)

ATT&CK: T1059.007

Detects HTTP requests to authentication endpoints where the username parameter contains HTML/JavaScript injection markers, consistent with exploitation of the Verint Verba stored XSS login-logging vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential Stored XSS Payload in Login Username Parameter
id: 8c35cb71-94f6-5027-a482-d947244568c3
status: experimental
description: 'Detects HTTP requests (typically failed login attempts) where the username

  field/parameter contains HTML or JavaScript injection syntax such as

  <script>, onerror=, javascript: or event handler attributes. This matches

  the exploitation pattern for CVE-2026-21730, a stored XSS in Verint Verba''s

  login logging mechanism, where an unauthenticated attacker submits a

  malicious username value that is later rendered unsanitized in the admin

  log viewer.

  '
references:
- CVE-2026-21730
author: Vorant
logsource:
  category: webserver
detection:
  selection_field:
    cs-uri-query|contains:
    - username=
    - user=
    - login=
  selection_payload:
    cs-uri-query|contains:
    - <script
    - '%3Cscript'
    - onerror=
    - onload=
    - 'javascript:'
    - <img
    - <svg
    - String.fromCharCode
  condition: selection_field and selection_payload
falsepositives:
- Authorized penetration testing or vulnerability scanning against the login form
- Security researchers validating the CVE-2026-21730 patch
level: high
tags:
- attack.T1059.007
- attack.initial_access
- cve.2026-21730
```

### Login Attempt with HTML/JS Encoded Username in POST Body

ATT&CK: T1059.007

Detects POST requests to authentication/login endpoints whose request body contains encoded or raw script injection syntax in the username field, indicating an attempt to exploit stored XSS via unauthenticated login logging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Login POST Request Body Containing Script Injection in Username Field
id: 63c2f344-5244-592e-b6bb-d8cfc0d34af2
status: experimental
description: 'Detects HTTP POST requests to authentication endpoints where the captured

  request body (as logged by a proxy, WAF, or reverse proxy) contains

  username values with embedded script tags, event handler attributes, or

  URL-encoded angle brackets. This behaviour matches unauthenticated

  exploitation attempts against the Verint Verba stored XSS login logging

  vulnerability (CVE-2026-21730), where the payload is stored and later

  executed in an administrator''s browser via the log viewer.

  '
references:
- CVE-2026-21730
author: Vorant
logsource:
  category: proxy
detection:
  selection_method:
    cs-method: POST
  selection_uri:
    cs-uri-stem|contains:
    - /login
    - /auth
    - /signin
  selection_payload:
    c-uri|contains:
    - <script
    - '%3Cscript'
    - onerror=
    - onload=
    - 'javascript:'
    - '&lt;script'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
- Automated web application security scanners testing for XSS on the login form
- QA/regression test suites submitting special characters as part of input validation
  testing
level: medium
tags:
- attack.T1059.007
- attack.T1189
- cve.2026-21730
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-21730

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e039ea98-5982-4f23-8514-c6463bd393fa/verint-verba-software-contains-a-stored-xss-vulnerability-cve-2026-21730.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup