CVE-2026-6371: LimRAD NAC Stored XSS Vulnerability

CVE-2026-6371 Overview

CVE-2026-6371 is a stored cross-site scripting (XSS) vulnerability in Limatek System Inc. LimRAD NAC, a network access control product. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker on an adjacent network can inject malicious script content that persists in the application and executes in the browsers of other users. The issue affects LimRAD NAC through build 08072026. According to the advisory, the vendor was contacted but did not respond to the disclosure.

Critical Impact
An authenticated adjacent-network attacker can store malicious JavaScript that executes in victim browsers, enabling session hijacking, UI manipulation, and cross-context data disclosure within the NAC management interface.

Affected Products

Limatek System Inc. LimRAD NAC through 08072026
Deployments exposing the LimRAD NAC management interface to internal or adjacent network segments
Administrative and operator user sessions within the LimRAD NAC web console

Discovery Timeline

2026-07-08 - CVE-2026-6371 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-6371

Vulnerability Analysis

The vulnerability resides in a web interface component of LimRAD NAC that renders user-supplied data without adequate output encoding. An attacker with low privileges submits crafted input through a form or API field that the application stores server-side. When another user later loads the affected page, the stored payload executes in the victim's browser context.

The CVSS vector indicates a scope change, meaning script execution can affect resources beyond the vulnerable component. Because LimRAD NAC governs network admission decisions, script execution in an administrator session can be leveraged to view sensitive policy data or trigger authenticated actions on behalf of the victim.

Root Cause

The root cause is missing or incomplete neutralization of special characters during HTML output generation. Input containing script tags, event handlers, or JavaScript URIs is persisted and later rendered as active markup. The application does not apply context-aware output encoding or a strict Content Security Policy that would block inline execution.

Attack Vector

Exploitation requires network adjacency, low-privileged authentication, and user interaction from a victim who visits the page containing the stored payload. The attacker submits the payload once through the vulnerable input field. Each subsequent view of the affected page by an authenticated user triggers execution. Typical objectives include stealing session cookies, forging administrative requests through the victim's session, and altering rendered NAC policy data.

No verified public proof-of-concept code is available. See the Turkish National Cyber Security advisory TR-26-0517 for further technical context.

Detection Methods for CVE-2026-6371

Indicators of Compromise

Stored fields in LimRAD NAC containing <script>, onerror=, onload=, or javascript: substrings.
Outbound HTTP requests from administrator browsers to unexpected external hosts shortly after loading LimRAD NAC pages.
Unexpected NAC configuration changes performed by administrator accounts without corresponding console activity.

Detection Strategies

Review LimRAD NAC application logs for POST or PUT requests containing HTML or JavaScript metacharacters submitted by low-privileged accounts.
Inspect stored database records used to render management pages for markup that should not appear in normal data fields.
Monitor web proxy logs for referrers pointing to LimRAD NAC URLs followed by anomalous cross-origin requests.

Monitoring Recommendations

Enable and centralize LimRAD NAC access and audit logs in a SIEM or data lake for retention and search.
Alert on administrator session activity originating from unusual user agents or IP addresses after page views on user-editable content.
Track configuration modification events in the NAC and correlate them with prior page loads of user-controlled fields.

How to Mitigate CVE-2026-6371

Immediate Actions Required

Restrict access to the LimRAD NAC management interface to a limited administrative VLAN or jump host.
Reduce the number of accounts able to write to fields rendered in shared administrative pages.
Review all existing stored records for markup or scripting content and sanitize suspicious entries.

Patch Information

At the time of publication, no vendor patch has been referenced in NVD, and the advisory notes the vendor did not respond to disclosure. Monitor the Turkish National Cyber Security advisory TR-26-0517 and vendor communications for a fixed build superseding 08072026.

Workarounds

Place the LimRAD NAC web console behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts.
Require administrators to use isolated browsers or browser profiles dedicated to NAC management to limit cookie and token exposure.
Enforce short session lifetimes and re-authentication for sensitive configuration actions to reduce the value of hijacked sessions.

bash

# Example reverse proxy header hardening (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;