Verint Verba stored XSS flaw enables code execution
Verint Verba software contains a stored XSS vulnerability (CVE-2026-21730) allowing unauthenticated attackers to execute malicious code in administrator browsers via login logs.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated the disclosure of CVE-2026-21730, a stored cross-site scripting vulnerability in Verint Verba software. The flaw exists in the login logging mechanism where unauthenticated attackers can inject malicious JavaScript payloads through the username field during failed authentication attempts. Due to insufficient input sanitization, these payloads are stored in application logs and subsequently executed when administrators access the log viewer interface.
The vulnerability requires no authentication and leverages the trust relationship between the logging system and administrative interfaces. When triggered, the malicious script executes in the security context of the administrator's browser session, potentially enabling session hijacking, credential theft, or privilege escalation. The vulnerability was responsibly disclosed by Jan Czerlunczakiewicz from STM Cyber and has been remediated in Verint Verba version 10.0.6.
Organizations running affected versions of Verint Verba should prioritize upgrading to version 10.0.6 or later. Administrators should also review historical login logs for suspicious username entries containing HTML or JavaScript syntax, as these may indicate exploitation attempts or compromised sessions.
Mentioned in this report
Detection guidance
Potential Stored XSS Payload in Login Username Parameter (CVE-2026-21730)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to authentication endpoints where the username parameter contains HTML/JavaScript injection markers, consistent with exploitation of the Verint Verba stored XSS login-logging vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Stored XSS Payload in Login Username Parameter
id: 8c35cb71-94f6-5027-a482-d947244568c3
status: experimental
description: 'Detects HTTP requests (typically failed login attempts) where the username
field/parameter contains HTML or JavaScript injection syntax such as
<script>, onerror=, javascript: or event handler attributes. This matches
the exploitation pattern for CVE-2026-21730, a stored XSS in Verint Verba''s
login logging mechanism, where an unauthenticated attacker submits a
malicious username value that is later rendered unsanitized in the admin
log viewer.
'
references:
- CVE-2026-21730
author: Vorant
logsource:
category: webserver
detection:
selection_field:
cs-uri-query|contains:
- username=
- user=
- login=
selection_payload:
cs-uri-query|contains:
- <script
- '%3Cscript'
- onerror=
- onload=
- 'javascript:'
- <img
- <svg
- String.fromCharCode
condition: selection_field and selection_payload
falsepositives:
- Authorized penetration testing or vulnerability scanning against the login form
- Security researchers validating the CVE-2026-21730 patch
level: high
tags:
- attack.t1059.007
- attack.initial-access
- cve.2026-21730
Login Attempt with HTML/JS Encoded Username in POST Body
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects POST requests to authentication/login endpoints whose request body contains encoded or raw script injection syntax in the username field, indicating an attempt to exploit stored XSS via unauthenticated login logging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Login POST Request Body Containing Script Injection in Username Field
id: 63c2f344-5244-592e-b6bb-d8cfc0d34af2
status: experimental
description: 'Detects HTTP POST requests to authentication endpoints where the captured
request body (as logged by a proxy, WAF, or reverse proxy) contains
username values with embedded script tags, event handler attributes, or
URL-encoded angle brackets. This behaviour matches unauthenticated
exploitation attempts against the Verint Verba stored XSS login logging
vulnerability (CVE-2026-21730), where the payload is stored and later
executed in an administrator''s browser via the log viewer.
'
references:
- CVE-2026-21730
author: Vorant
logsource:
category: proxy
detection:
selection_method:
cs-method: POST
selection_uri:
cs-uri-stem|contains:
- /login
- /auth
- /signin
selection_payload:
c-uri|contains:
- <script
- '%3Cscript'
- onerror=
- onload=
- 'javascript:'
- '<script'
condition: selection_method and selection_uri and selection_payload
falsepositives:
- Automated web application security scanners testing for XSS on the login form
- QA/regression test suites submitting special characters as part of input validation
testing
level: medium
tags:
- attack.t1059.007
- attack.t1189
- cve.2026-21730
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-21730
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs