CVE-2026-32963

BRIEFING NOTE: CVE-2026-32963 SD-330AC and AMC Manager devices manufactured by Silex Technology, Inc. contain a reflected cross-site scripting (XSS) vulnerability that allows arbitrary script execution in a user's browser when they visit a crafted web page after logging into the affected device. The vulnerability requires user interaction and is network-accessible without authentication, making it a phishing or social engineering attack vector. The vulnerability carries a CVSS score of 6.1 (MEDIUM severity) with an attack vector that is network-based, requires low complexity, and necessitates user interaction. The attack can affect confidentiality and integrity across security boundaries through session hijacking or credential theft, though availability is not impacted. The FAUCET Risk Score of 34.0 out of 100 indicates a moderate overall risk profile. Currently, there is no evidence of active exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the Hot List is inactive, and the EPSS score of 0.0003 indicates minimal probability of exploitation in the wild. Community attention appears limited at this time, and no public exploit code has been identified, suggesting this remains a low-priority threat requiring standard patching procedures.