CVE-2026-25136

HighPublic PoC

Published: 25 February 2026

Published

25 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Score 0.0008 23.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25136 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Cern Rucio. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-11 Error Handling good match

prevent

Requires secure error handling that prevents the reflection of unsanitized user input in 500 error page ExceptionMessages, directly mitigating the reflected XSS vulnerability.

SI-15 Information Output Filtering good match

prevent

Mandates filtering of information prior to output on web interfaces, ensuring XSS payloads in error pages are encoded and cannot execute in victims' browsers.

SI-10 Information Input Validation partial match

prevent

Validates malicious inputs from crafted URLs before processing, reducing the risk of XSS payloads triggering exploitable 500 errors.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Reflected XSS in WebUI (CWE-79 + CWE-1004) permits arbitrary JS execution in victim browser via malicious URL, directly enabling web session cookie theft and browser session hijacking.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of…

the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Deeper analysisAI

CVE-2026-25136 is a reflected Cross-Site Scripting (XSS) vulnerability, classified under CWE-79 and CWE-1004, in Rucio, a software framework for organizing, managing, and accessing large volumes of scientific data. The issue resides in the WebUI component, specifically the rendering of the ExceptionMessage on 500 error pages, affecting all versions prior to 35.8.3, 38.5.4, and 39.3.1.

Attackers without privileges (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) by crafting a malicious URL that triggers a 500 error containing an XSS payload in the ExceptionMessage. Exploitation requires user interaction (UI:R), such as a victim navigating to the URL, after which the payload executes in the victim's browser context. This enables theft of login session tokens, resulting in high impacts to confidentiality and integrity but none to availability (CVSS v3.1 score: 8.1; C:H/I:H/A:N/S:U).

Mitigation is provided via patches in Rucio versions 35.8.3, 38.5.4, and 39.3.1, with release notes available on GitHub. Further details, including the fix implementation, are documented in the project's security advisory at GHSA-h79m-5jjm-jm4q. General XSS prevention strategies are outlined in the OWASP Cross-Site Scripting Prevention Cheat Sheet.