CVE-2026-40321

DNN (DotNetNuke) versions prior to 10.2.2 contain a stored cross-site scripting vulnerability that allows authenticated users to upload specially crafted SVG files containing executable scripts. These scripts can be triggered against both authenticated and unauthenticated users, with heightened risk if executed by privileged users. The vulnerability affects this popular open-source content management platform widely used in Microsoft ecosystems. The vulnerability carries a CVSS score of 8.0 (HIGH) with a network-based attack vector requiring low authentication privileges and user interaction. The attack complexity is moderate, and successful exploitation could result in high-impact consequences including confidentiality, integrity, and availability compromise. The FAUCET Risk Score of 49.0 indicates moderate overall risk when considering additional contextual factors. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on the Hot List, suggesting minimal community attention or available public exploit code. Organizations should prioritize patching to version 10.2.2 as part of standard maintenance activities, though immediate emergency response is not warranted based on current exploitation status.