Is CVE-2026-27964 actively exploited?

No active exploitation of CVE-2026-27964 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27964 be exploited remotely?

No. CVE-2026-27964 requires local access to exploit.

What is the CVSS score of CVE-2026-27964?

CVE-2026-27964 has a CVSS score of 3.9 (LOW).

HOME VULNERABILITIESCVE-2026-27964

LOW

CVE-2026-27964

CWE-79Published: May 18, 2026· Updated: May 19, 2026

3.9

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.9th

Official Description

FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8.

NVD Source

Technical Analysis

CVE-2026-27964 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.