CVE-2026-16969

HIGH

DFIR-IRIS Stored XSS in Assets

Title source: cna

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

Core 1

Core References

Third Party Advisory third-party-advisory

CVSS v3 7.6

EPSS 0.0028

EPSS Percentile 20.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (1)

dfir-iris/iris-web 2.4.26

Published Jul 30, 2026

Tracked Since Jul 30, 2026