CVE-2026-7380: Armiya Access Control System XSS Flaw

CVE-2026-7380 Overview

CVE-2026-7380 is a cross-site scripting (XSS) vulnerability affecting the Armiya Information Technologies Ltd. Co. Access Control System (GKS). The flaw stems from improper neutralization of script-related HTML tags in a web page, mapped to [CWE-80]. Attackers can inject malicious scripts that target HTML attributes rendered by the application. Successful exploitation requires user interaction, such as clicking a crafted link. The scope is changed, meaning injected code can affect resources beyond the vulnerable component. All versions of GKS prior to Version 2 are affected.

Critical Impact
Remote attackers can execute arbitrary JavaScript in the context of an authenticated user's browser session, enabling session theft, credential harvesting, and unauthorized actions within the access control system.

Affected Products

Armiya Information Technologies Ltd. Co. Access Control System (GKS) before Version 2

Discovery Timeline

2026-07-07 - CVE-2026-7380 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-7380

Vulnerability Analysis

The Armiya GKS web application fails to neutralize script-related HTML tags before rendering user-controlled input inside HTML attribute contexts. This class of flaw, categorized under [CWE-80], is commonly known as basic XSS. When input reaches an attribute such as value, href, or an event handler without proper encoding, an attacker can break out of the attribute context and inject executable JavaScript.

Because the CVSS vector indicates a changed scope with user interaction required, exploitation typically occurs through a reflected or stored payload delivered via a crafted URL or form submission. The attack executes in the browser of a targeted GKS user, potentially an administrator responsible for physical access control configuration.

Root Cause

The root cause is missing or insufficient output encoding when user-supplied data is inserted into HTML attribute values. The application does not neutralize characters such as quotes, angle brackets, and event handler prefixes before rendering. As a result, attribute contexts become injection points for JavaScript payloads.

Attack Vector

An attacker crafts a URL or input that includes a script payload targeting an HTML attribute in a GKS page. The attacker delivers the link through phishing, chat, or an embedded resource. When a logged-in GKS user follows the link, the browser executes the injected script under the origin of the GKS application. The attacker can then exfiltrate session cookies, invoke authenticated endpoints, or manipulate access control settings within the user's privilege scope.

No verified public proof-of-concept code is available. See the Siber Güvenlik Turkey Advisory for vendor-coordinated details.

Detection Methods for CVE-2026-7380

Indicators of Compromise

Web server access logs containing URL parameters with <script>, onerror=, onload=, or javascript: sequences directed at GKS endpoints.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after clicking internal or external links.
Anomalous session activity in GKS audit logs, including configuration changes performed from unusual client fingerprints.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect request parameters and headers for HTML attribute-breaking sequences such as quote characters followed by event handler keywords.
Enable browser telemetry collection on endpoints used to administer GKS, and correlate script execution events against known-good baselines.
Review application logs for reflected input echoed back to clients within HTML attribute contexts.

Monitoring Recommendations

Monitor authentication and authorization events in GKS for session reuse from multiple IP addresses or user agents.
Alert on any GKS administrator account performing high-privilege actions immediately after email or messaging link clicks.
Track EPSS movement for CVE-2026-7380, currently reported at 0.149% (percentile 4.51), to identify shifts that indicate active weaponization.

How to Mitigate CVE-2026-7380

Immediate Actions Required

Upgrade Armiya Access Control System (GKS) to Version 2 or later, which addresses the improper neutralization flaw.
Restrict access to the GKS web interface to trusted management networks using network segmentation and VPN enforcement.
Instruct administrators to avoid clicking untrusted links while authenticated to GKS and to use dedicated management browsers.

Patch Information

Armiya Information Technologies Ltd. Co. addresses CVE-2026-7380 in Access Control System (GKS) Version 2. Operators running any earlier release should plan an immediate upgrade. Refer to the Siber Güvenlik Turkey Advisory for coordinated vendor guidance and update instructions.

Workarounds

Enforce a strict Content Security Policy (CSP) on GKS responses to block inline script execution and restrict script sources.
Configure upstream reverse proxies or WAFs to filter requests containing attribute-breaking payloads targeting GKS URLs.
Require multi-factor authentication for all GKS administrator accounts to limit the impact of hijacked session tokens.

bash

# Example nginx reverse proxy hardening for the GKS application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;