CVE-2026-23758

CVE-2026-23758 is a stored cross-site scripting vulnerability affecting GFI HelpDesk versions prior to 4.99.9. The flaw exists in the ticket subject field where inadequate input sanitization in the EditSubject POST parameter allows authenticated staff members to inject malicious JavaScript code that executes when other staff or administrators view the compromised ticket. The vulnerability requires authentication and low complexity to exploit, making it primarily a threat from insider actors or compromised staff accounts. While the complete CVSS metrics are unavailable, the moderate FAUCET Risk Score of 44/100 suggests meaningful concern, though the extremely low EPSS score of 0.0005 indicates minimal real-world exploitation probability at present. There is no evidence of active exploitation in the wild, and this vulnerability is not tracked on CISA's Known Exploited Vulnerabilities list. The minimal community attention and inactive hot list status suggest limited immediate threat. Organizations running affected versions should prioritize patching to version 4.99.9 or later, particularly if they have elevated concerns about insider threats or compromised administrator accounts.