CVE-2026-26460

CVE-2026-26460 is an HTML injection vulnerability affecting the Dashboard module in Vtiger CRM version 8.4.0. The flaw exists in the DashBoardTab view where the tabid parameter fails to properly sanitize user-supplied input, allowing attackers to inject arbitrary HTML content that renders in victim browsers. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium severity) with a network-based attack vector requiring no special privileges but demanding user interaction. The attack has limited scope with potential for confidentiality and integrity compromise, though availability is not impacted. The FAUCET Risk Score of 34.0 out of 100 indicates a moderate threat level relative to other vulnerabilities. Current exploitation status shows no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and it has generated minimal community attention with an EPSS score of 0.00031, placing it in the lowest percentile of exploited vulnerabilities. No publicly available exploit code has been documented at this time.