CVE-2026-12425: PowerSchool Employee Access XSS Flaw

CVE-2026-12425 Overview

CVE-2026-12425 is a reflected Cross-Site Scripting (XSS) vulnerability in PowerSchool Employee Access Center version 23.10. The application fails to neutralize user-supplied input appended to the login URL before passing it to a JavaScript eval() call within the rendered page. An attacker can craft a malicious URL containing JavaScript that executes in the browser context of any victim who follows the link.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the authenticated session of an Employee Access Center user, enabling session theft, credential harvesting, and unauthorized actions against the HR portal.

Affected Products

PowerSchool Employee Access Center 23.10

Discovery Timeline

2026-06-16 - CVE-2026-12425 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12425

Vulnerability Analysis

The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation. The Employee Access Center login endpoint accepts trailing input on the URL and concatenates it into a server-rendered response. The rendered page then passes that value to the JavaScript eval() function, which executes the string as code. Because input is neither sanitized nor encoded, any JavaScript supplied by an attacker runs in the origin of the Employee Access Center application.

Exploitation requires user interaction. A victim must click a crafted link or visit an attacker-controlled page that redirects to the vulnerable URL. Once the script executes, it inherits the privileges of the current browser session, including access to cookies that are not marked HttpOnly, session storage, and any HR data the authenticated user can view.

The EPSS probability is 0.258%, placing the vulnerability in the 16.9 percentile for likelihood of exploitation activity within the next 30 days. No public proof-of-concept exploit is currently catalogued in ExploitDB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is direct use of unsanitized URL input as an argument to eval() in client-side JavaScript emitted by the server. The application treats post-login URL fragments as trusted data rather than untrusted input.

Attack Vector

The attack vector is network-based and requires passive user interaction. An attacker delivers a malicious URL through email, chat, or a compromised web page. When an authenticated employee opens the link, the injected payload executes within the Employee Access Center origin.

No verified exploit code is published. See the Palo Alto Networks Unit 42 disclosure for additional technical detail.

Detection Methods for CVE-2026-12425

Indicators of Compromise

Inbound HTTP requests to Employee Access Center login URLs containing <script>, javascript:, onerror=, or URL-encoded equivalents in the path or query string.
Web server access logs showing unusually long URL fragments appended after the standard login path for version 23.10.
Browser error or console events on employee endpoints referencing eval execution failures originating from the Employee Access Center domain.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for XSS payload signatures targeting the Employee Access Center login endpoint.
Correlate HTTP referrer fields with external sources to identify users redirected to crafted login URLs from untrusted domains.
Review outbound requests from employee browsers to unexpected destinations immediately after Employee Access Center visits, which can indicate exfiltration of session data.

Monitoring Recommendations

Enable verbose access logging on the Employee Access Center web tier and forward logs to a centralized analytics platform for query and alerting.
Configure alerts on HTTP 200 responses to login URLs containing script tag patterns or encoded JavaScript keywords.
Monitor for anomalous session token usage, such as concurrent logins from disparate geographies, following user clicks on external links.

How to Mitigate CVE-2026-12425

Immediate Actions Required

Identify all instances of PowerSchool Employee Access Center 23.10 in your environment and restrict external exposure where feasible.
Contact PowerSchool support to obtain remediation guidance and any available fixed release for Employee Access Center.
Communicate to employees the risk of clicking unsolicited links that reference the Employee Access Center login URL.

Patch Information

No vendor patch reference is published in the NVD entry at the time of disclosure. Administrators should consult PowerSchool directly and review the Unit 42 advisory for updates.

Workarounds

Deploy a WAF rule that blocks or strips JavaScript payloads, script tags, and URL-encoded script keywords from requests to the Employee Access Center login path.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution and unsafe-eval on the Employee Access Center domain.
Set the HttpOnly and Secure flags on session cookies to limit the impact of script execution against authenticated sessions.
Restrict Employee Access Center access to trusted networks or via VPN until vendor remediation is applied.

bash

# Example WAF rule (ModSecurity) blocking script payloads on the login URL
SecRule REQUEST_URI "@rx (?i)/employeeaccesscenter/.*(<script|javascript:|onerror=|%3Cscript)" \
    "id:1029425,phase:2,deny,status:403,log,msg:'Possible CVE-2026-12425 XSS payload'"