CVE-2026-66300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66300", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "state": "PUBLISHED", "assignerShortName": "cisa-cg", "dateReserved": "2026-07-24T15:58:38.179Z", "datePublished": "2026-08-04T18:51:27.626Z", "dateUpdated": "2026-08-04T18:58:36.936Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "SNOMED International Snowstorm contains a reflected XSS vulnerability within the \"Web Route\" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3."}], "affected": [{"vendor": "SNOMED International", "product": "Snowstorm", "defaultStatus": "unknown", "versions": [{"version": "7.0.0", "status": "affected", "lessThan": "10.12.2", "versionType": "custom"}, {"version": "10.12.2", "status": "unaffected"}, {"version": "10.9.3", "status": "unaffected"}]}], "problemTypes": [{"descriptions": [{"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE", "cweId": "CWE-79"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T16:06:49.793385Z", "id": "CVE-2026-66300", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "SNOMED International Snowstorm reflected XSS", "references": [{"name": "url", "url": "https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39", "tags": ["patch"]}, {"name": "url", "url": "https://github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6", "tags": ["patch"]}, {"name": "url", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66300", "tags": ["vdb-entry"]}, {"name": "url", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-212-01.json", "tags": ["third-party-advisory"]}], "credits": [{"value": "Michael Milkovich, CISA", "lang": "en"}, {"value": "Karl Meister, CISA", "lang": "en"}], "datePublic": "2026-07-24T00:00:00.000Z", "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2026-08-04T18:51:27.626Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T18:58:26.743125Z", "id": "CVE-2026-66300", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T18:58:36.936Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T18:58:26.743125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T18:58:32.291Z"}}], "cna": {"title": "SNOMED International Snowstorm reflected XSS", "credits": [{"lang": "en", "value": "Michael Milkovich, CISA"}, {"lang": "en", "value": "Karl Meister, CISA"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-66300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T16:06:49.793385Z"}}}], "affected": [{"vendor": "SNOMED International", "product": "Snowstorm", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "10.12.2", "versionType": "custom"}, {"status": "unaffected", "version": "10.12.2"}, {"status": "unaffected", "version": "10.9.3"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-24T00:00:00.000Z", "references": [{"url": "https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39", "name": "url", "tags": ["patch"]}, {"url": "https://github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6", "name": "url", "tags": ["patch"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-66300", "name": "url", "tags": ["vdb-entry"]}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-212-01.json", "name": "url", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "SNOMED International Snowstorm contains a reflected XSS vulnerability within the \"Web Route\" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2026-08-04T18:51:27.626Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66300", "state": "PUBLISHED", "dateUpdated": "2026-08-04T18:58:36.936Z", "dateReserved": "2026-07-24T15:58:38.179Z", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "datePublished": "2026-08-04T18:51:27.626Z", "assignerShortName": "cisa-cg"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Snowstorm", "vendor": "SNOMED International", "versions": [{"lessThan": "10.12.2", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "10.12.2"}, {"status": "unaffected", "version": "10.9.3"}]}], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SNOMED International Snowstorm contains a reflected XSS vulnerability within the \"Web Route\" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3."}, {"lang": "es", "value": "SNOMED International Snowstorm contiene una vulnerabilidad de XSS reflejado dentro de la funcionalidad de redirecci\u00f3n \u2019Web Route\u2019. Un atacante puede inyectar JavaScript arbitrario que se ejecutar\u00e1 cuando un usuario objetivo navegue a un enlace malicioso y dise\u00f1ado espec\u00edficamente. Corregido en 10.12.2 y 10.9.3."}], "id": "CVE-2026-66300", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}], "ssvcV203": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "ssvcData": {"id": "CVE-2026-66300", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T16:06:49.793385Z", "version": "2.0.3"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66300", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T18:58:26.743125Z", "version": "2.0.3"}}]}, "published": "2026-08-04T19:16:51.970", "references": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "url": "https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39"}, {"source": "9119a7d8-5eab-497f-8521-727c672e3725", "url": "https://github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6"}, {"source": "9119a7d8-5eab-497f-8521-727c672e3725", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-212-01.json"}, {"source": "9119a7d8-5eab-497f-8521-727c672e3725", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66300"}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,10.12.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.12.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.9.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Snowstorm", "source": "cna", "vendor": "SNOMED International"}, "product": "snowstorm", "vendor": "snomed_international"}], "created": "2026-08-04T20:30:05.082220+00:00", "updated": "2026-08-05T10:19:05.857503+00:00", "vendors": ["snomed_international", "snomed_international$PRODUCT$snowstorm"]}