CVE-2026-116405
HIGH
CVSS 7.1
PoC Available
Published: 2026-10-30
Modified: 2026-10-30
Enriched via mock
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-116405 is a high-severity vulnerability with a CVSS score of 7.1 affecting the target software. Authentication can be bypassed allowing unauthenticated access. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
Attack Chain
1
Reconnaissance
Attacker identifies authentication endpoint and tests for bypass conditions
2
Initial Access
Attacker exploits CVE-2026-116405 authentication flaw to gain unauthorized access without valid credentials
3
Discovery
Attacker enumerates accessible resources, users, and configurations
4
Collection
Attacker exfiltrates sensitive data accessible without proper authorization
MITRE ATT&CK Techniques
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params |
Remediation
1. Apply vendor-supplied security patches immediately.
2. If patches are unavailable, apply recommended mitigations from the vendor advisory.
3. Enable WAF rules or IDS signatures to detect exploitation attempts.
4. Monitor logs for indicators of compromise listed above.
5. Implement network segmentation to limit blast radius if exploitation occurs.
6. Subscribe to vendor security advisories for this product.
Quick Facts
| CVE ID | CVE-2026-116405 |
| CVSS Score | 7.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| Published | 2026-10-30 |
| Exploited | No |
| CISA KEV | No |
| PoC | Available |