External risk intelligence

Stored XSS in OCSReports Notification Templates Leading to Admin Session Compromise.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-76178

The vulnerability requires administrator privileges and interaction with a specific internal management endpoint within the application. While the application is network-accessible, the attack requires high-level privileges and specific user interaction within the administrative interface, making public internet exposure of the vulnerable workflow uncommon.

Cross-site Scripting

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a stored Cross-Site Scripting vulnerability within the notification template feature of a specific reporting tool. The issue arises when administrators input malicious content that is then stored and executed, potentially compromising the sessions of other administrators using the template customization view.

Stored malicious content can run unauthorized code.
Threat to administrator sessions and application security.
Confirm relevance and potential exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker with administrator privileges can inject malicious HTML into notification templates. When other administrators view these templates, the stored malicious content executes as JavaScript, potentially compromising their sessions.

Requires administrator privileges.
Vulnerable notification templates.
Compromise of administrator sessions.

Live Threat

Current exploitation, exposure, and threat context

A stored Cross-Site Scripting vulnerability in the notification template functionality could allow an authenticated administrator to inject malicious HTML and JavaScript. When other administrators view the notification template customization, this script could execute within their browser's security context, potentially affecting their active sessions.

Administrator sessions.
Via crafted notification templates.
Unauthorized administrative actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The stored cross-site scripting vulnerability in the notification template functionality is likely to affect application owners and platform teams responsible for the OCS Inventory NG instance. The first actionable step is to identify all deployed instances of the affected technology, confirm their network exposure and business criticality, and then identify the accountable system owner to initiate a risk-based remediation plan.

Application owners should own the remediation.
Verify administrative access and template usage.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OCS Inventory NG?

OCS Inventory NG is an IT asset management solution designed to help administrators track hardware and software configurations across a network. It uses OCSReports as a web-based interface for managing this data, generating reports, and configuring automated notifications. This system acts as a centralized console for IT teams to gain visibility into the devices connected to their infrastructure.

What does CVE-2026-76178 mean?

This CVE identifies a stored Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. In plain terms, the application fails to properly sanitize input in notification templates. Because the system saves this input, it can store malicious scripts. When another administrator later views that template, their browser executes the hidden script, potentially allowing an attacker to hijack their active session or perform unauthorized actions on their behalf.

How is this vulnerability triggered?

An attacker must already have administrator-level credentials to access and modify the notification template settings within OCSReports. The vulnerability does not trigger through simple network requests or public access; it requires the active participation of an administrator who manually saves malicious HTML code into the template and the subsequent action of another administrator navigating to that specific template customization view.

Is my instance affected by this vulnerability?

Halo Surface Signal indicates that while OCSReports may be network-accessible, the specific administrative workflow required for this attack makes widespread public internet exposure less likely. You should focus on internal access points where administrators manage notification templates. If your team does not use or customize these notification templates, the risk is significantly reduced, though administrative account security remains a priority.

How should I respond to CVE-2026-76178?

Begin by identifying all deployed instances of OCS Inventory NG within your organization to understand where this management interface exists. Coordinate with the designated system owners to verify who has administrative access to notification templates. Review your internal security policies regarding administrative account management and monitor for any suspicious configuration changes while awaiting further guidance or patches from the vendor.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.