CVE-2026-31981

Name of the Vulnerable Software and Affected Versions Guardian/CMC versions prior to 26.2.0

Description A stored HTML injection issue exists in the Diagram tab and Graph view caused by an insufficiently restrictive shared input validation function. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data. When a victim views this data, the HTML renders in the browser, which may facilitate phishing or open redirect attacks. Full Cross-Site Scripting (XSS) and direct information disclosure are mitigated by the current Content Security Policy and input validation.

Recommendations Update Guardian/CMC to version 26.2.0 or later.