CVE-2026-96873
📛 CVE Title
Reflected XSS in CirrusSearch debug explain output
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- wikimedia-foundation
- CVSS severity
- MEDIUM
- CVSS score
- 5.5 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P- Effective score
- 5.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-09-23
- Published
- 2026-09-24 15:27 UTC
- Last updated
- 2026-09-24 15:38 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96873.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 16:17:28 UTC
- NVD last modified
- 2026-09-24 20:02:50 UTC
NVD / KEV / EPSS data refreshed 2026-09-25 04:28 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-86230 - Assigner
- wikimedia-foundation
- Published
- Sep 24, 2026, 3:27:31 PM
- Updated
- Sep 24, 2026, 3:38:37 PM
- EUVD base score (CVSS 4.0)
-
5.5 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - EUVD-reported EPSS
- 0.0000
- Vendors
- The Wikimedia Foundation
- Products
-
Mediawiki - CirrusSearch Extension (0 ≤1.46.0)
- Aliases
-
GHSA-fv8h-v7wg-hwcx
ENISA description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| The Wikimedia Foundation | Mediawiki - CirrusSearch Extension |
0 (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CirrusSearch/+/1344368 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
- https://phabricator.wikimedia.org/T435234 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Remediations (10)
-
web:arcticwolf.com
CVE - 2026 -6875: Critical Remote Code Execution Vulnerability in ServiceNow AI Platform Urgent Mitigation Required CRITICAL: ServiceNow AI Platform CVE - 2026 -6875 unauthenticated sandbox escape RCE actively exploited. Self-hosted instances: patch to Australia Patch 2, Yokohama 13+, Zurich 9+ immediately.
2026-09-25 10:43 UTC -
web:blogs.oracle.com
For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.
2026-09-25 10:43 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-25 10:43 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 10:43 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-25 10:43 UTC -
web:support.servicenow.com
ServiceNow has addressed a critical remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability, tracked as CVE - 2026 -6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. Resolution
2026-09-25 10:43 UTC -
web:www.action1.com
This CISO-focused summary highlights the vulnerabilities and critical infrastructure risks that should take priority for remediation following Microsoft's September 2026 Patch Tuesday release.
2026-09-25 10:43 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:43 UTC -
web:www.oracle.com
Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...
2026-09-25 10:43 UTC -
web:www.rescana.com
Mitigation and Countermeasures Immediate action is required to mitigate the risk posed by CVE - 2026 -6875. Organizations should apply the July 13, 2026 , ServiceNow security update to all self-hosted instances without delay. Hosted ServiceNow environments have been patched by the vendor, but verification is recommended.
2026-09-25 10:43 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-96873.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T15:37:53.640849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:38:37.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mediawiki - CirrusSearch Extension",
"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/CirrusSearch",
"vendor": "The Wikimedia Foundation",
"versions": [
{
"lessThanOrEqual": "1.46.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "bombobombone"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.<p>This issue affects Mediawiki - CirrusSearch extension through 1.46.0.</p>"
}
],
"value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.\n\nThis issue affects Mediawiki - CirrusSearch extension through 1.46.0."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:27:31.697Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CirrusSearch/+/1344368"
},
{
"url": "https://phabricator.wikimedia.org/T435234"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected XSS in CirrusSearch debug explain output",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2026-96873",
"datePublished": "2026-09-24T15:27:31.697Z",
"dateReserved": "2026-09-23T18:13:31.629Z",
"dateUpdated": "2026-09-24T15:38:37.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}