External risk intelligence

SOCFortress CoPilot Stored Cross-Site Scripting and Token Theft Leads to Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-61728

The vulnerability affects a security operations portal, which is typically deployed as a centralized, web-based management platform. Because such applications are designed to be accessible by analysts and administrators, often across different locations or networks, and provide a web-based interface for security management, they are commonly deployed as internet-facing or externally reachable services.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts the SOCFortress CoPilot platform, a security operations tool. It allows unauthorized script execution within the portal, potentially enabling attackers to steal user credentials and gain elevated access. This could lead to significant compromise of security data and operations.

Stored script injection in security portal.
Potential for privileged account takeover.
Confirm relevance and exposure to security operations.

Attack Path

How an attacker could exploit the issue

An attacker can target users of the SOCFortress CoPilot portal by injecting malicious HTML into comments or case notes. If another user, particularly an analyst or administrator, views the content containing this stored markup, the embedded script will execute within their browser on the application's origin. This allows the attacker to potentially steal authentication tokens, impersonate the user, and gain unauthorized access to sensitive security operations data and functions.

Requires portal user access.
Malicious markup in comments or notes.
Privileged account takeover and data access.

Live Threat

Current exploitation, exposure, and threat context

When a user views a poisoned alert or case, stored scripts can execute within the application's origin. This could lead to the theft of authentication tokens, enabling an attacker to impersonate the viewer and potentially gain persistent access to privileged accounts, access data across different tenants, or modify and delete incidents.

User tokens and account access.
Script injection via unsanitized input.
Privileged account takeover and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SOCFortress CoPilot application owner and platform teams are likely responsible for addressing this vulnerability. The first practical move is to identify all instances of the affected technology, confirm its exposure and business criticality, and identify the specific accountable owner for each deployment to plan remediation.

Own the issue.
Verify token storage and reachability.
Plan coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SOCFortress CoPilot?

SOCFortress CoPilot is a security operations platform designed to aggregate data into a single interface. It helps security teams manage incident responses, track assets, and monitor health checks within a unified web-based portal.

How does CVE-2026-61728 work?

This vulnerability involves Stored Cross-Site Scripting (CWE-79) and Insecure Storage of Sensitive Information (CWE-922). The portal fails to sanitize user-submitted HTML in comments and notes, allowing malicious scripts to execute in other users' browsers. Because the application stores authentication tokens in accessible memory, these scripts can steal tokens to hijack user sessions.

What triggers this vulnerability?

An attacker triggers this by submitting malicious markup through specific API endpoints or form fields for alerts, cases, or health checks. The bug executes only when a legitimate user, such as an administrator or analyst, opens the affected record. Simply having the data stored in the database does not trigger the execution; the victim's browser must render the poisoned content.

Do I need to worry about this if my CoPilot instance is internal?

While internal deployments have different risks, Halo Surface Signal notes that security portals are often designed for broad analyst access, making them common targets. Even if your instance is not directly on the public internet, an attacker with basic portal user access can exploit this to move laterally, impersonate privileged accounts, and compromise the security data your team relies on.

How should I respond to this vulnerability?

Start by identifying all CoPilot deployments in your environment and determining who manages them. Coordinate with your platform teams to verify your current version. You must update to version 0.1.76 or later, as this release contains the necessary code repairs to properly sanitize inputs and secure the handling of authentication tokens.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.