Vulnerability Intelligence Report
Cross-Site Scripting Vulnerability in SiteMinder Administrative UI
CVE-2026-3862
Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page.
No Active Exploit Signals
CVSS Base Score
4.6
MEDIUM
EPSS Probability:0.19%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-79 ↗CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Broadcom | SiteMinder | 12.9 (affected), 12.8.x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.191%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Symantec - A Division of Broadcom · Vendor · USA |
| Reserved | 2026-03-10T05:13:18 |
| Published | 2026-03-10T14:52:52 |
| Last Updated | 2026-03-10T15:40:24 |
Community Chatter & Buzz