CVE-2026-40464: NSP Workflow Stored XSS Vulnerability

CVE-2026-40464 Overview

CVE-2026-40464 is a stored Cross-Site Scripting (XSS) vulnerability in Nokia Network Services Platform (NSP). The flaw stems from insufficient validation and encoding of user-controlled input within a workflow application component. An authenticated attacker with access to the workflow application can embed malicious script content that executes in the browser of other users who view the affected content [CWE-79].

Critical Impact
Successful exploitation allows an authenticated attacker to execute arbitrary script in a victim's browser session, enabling session data theft, UI manipulation, and pivoting against other NSP operators.

Affected Products

Nokia Network Services Platform (NSP) — workflow application component

Discovery Timeline

2026-08-31 - CVE-2026-40464 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-40464

Vulnerability Analysis

The vulnerability resides in a workflow application within Nokia NSP. User-supplied input is stored by the application without adequate sanitization or output encoding. When another authenticated user later renders the stored content in the NSP web interface, the browser interprets attacker-controlled markup as executable script.

Because the payload is persisted server-side, the attack does not require the victim to click a crafted link. Any user who visits the affected workflow view triggers script execution automatically. The scope change indicated in the CVSS vector reflects that the injected script runs in the victim's browser context, potentially crossing trust boundaries within the NSP management console.

Exploitation requires authenticated access with permission to interact with the workflow application. It also requires user interaction from a victim who views the tainted workflow content.

Root Cause

The root cause is missing or incomplete input validation and output encoding in the workflow application's handling of user-controlled fields. Data that should be treated as inert text is rendered as HTML or JavaScript when displayed. This is a classic instance of improper neutralization of input during web page generation, tracked under CWE-79.

Attack Vector

An authenticated attacker submits a workflow entry containing an XSS payload through the workflow application interface. The payload is stored in the NSP backend. When a second user with access to the workflow views the record, the malicious script executes with the privileges of that user's session. The attacker can steal session tokens, perform actions on behalf of the victim, or manipulate the rendered management UI.

No verified public exploit code is available for CVE-2026-40464. For technical details, refer to the Nokia Security Advisory CVE-2026-40464.

Detection Methods for CVE-2026-40464

Indicators of Compromise

Workflow records or form fields containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs
Unexpected outbound HTTP requests originating from operator browsers to attacker-controlled domains shortly after opening a workflow view
NSP audit log entries showing workflow creation or edits by low-privileged accounts followed by unusual session activity from higher-privileged operators

Detection Strategies

Inspect stored workflow records for markup characters and script fragments in fields that should contain plain text
Enable and review web application firewall (WAF) logs in front of the NSP UI for reflected script payload patterns submitted to workflow endpoints
Correlate workflow authoring events with subsequent anomalous administrative actions by users who viewed those workflows

Monitoring Recommendations

Monitor browser Content Security Policy (CSP) violation reports generated by NSP operator sessions
Track authentication and session-token anomalies for NSP administrator accounts, including concurrent sessions and unexpected source IPs
Alert on new or modified workflow definitions submitted by accounts that do not routinely author workflows

How to Mitigate CVE-2026-40464

Immediate Actions Required

Apply the fixed NSP release identified in the Nokia Security Advisory as soon as it is available in your maintenance channel
Restrict access to the workflow application to the minimum set of trusted, authenticated operators
Audit existing workflow records for stored script payloads and remove any suspicious entries

Patch Information

Nokia has published a product security advisory for this issue. Refer to the Nokia Security Advisory CVE-2026-40464 for fixed version information and vendor-recommended upgrade guidance.

Workarounds

Limit workflow application permissions so only vetted users can create or edit workflow content
Enforce a strict Content Security Policy on the NSP web interface to reduce the impact of injected script
Require operators to access the NSP management console from hardened, dedicated administrative workstations
Rotate NSP session secrets and administrator credentials if stored XSS activity is suspected

bash

# Example CSP header to reduce XSS impact on the management UI
# Apply at the reverse proxy fronting the NSP web console
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'