CVE-2026-79035: Zeta Marketing Platform XSS Vulnerability

CVE-2026-79035 Overview

CVE-2026-79035 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0. Attackers can inject a crafted URL into the ca parameter to execute arbitrary JavaScript in the victim's browser. Exploitation requires user interaction, typically by clicking a malicious link. Successful attacks run script code in the origin of the vulnerable endpoint, enabling session token theft, credential harvesting through fake overlays, and unauthorized actions performed as the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser session, enabling data theft and account impersonation across the p.rfihub.com origin.

Affected Products

Zeta Marketing Platform (ZMP) v1.0
p.rfihub.com component
Applications embedding or redirecting through the vulnerable ca parameter

Discovery Timeline

2026-09-11 - CVE-2026-79035 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-79035

Vulnerability Analysis

The vulnerability resides in how the p.rfihub.com endpoint of Zeta Marketing Platform handles the ca query parameter. The application reflects attacker-controlled input into the HTTP response without proper output encoding or input sanitization. When a victim requests a crafted URL, the browser parses the reflected payload as executable script within the response origin.

Because the attack vector is network-based and no authentication is required, any user who clicks a weaponized link becomes a target. The scope change component indicates that the injected script can affect resources beyond the vulnerable component, including cookies or tokens shared with sibling origins. Attackers commonly weaponize reflected XSS through phishing emails, malicious advertisements, or embedded iframes.

Root Cause

The root cause is missing neutralization of user-supplied input during web page generation, tracked as [CWE-79]. The ca parameter is written into the response body or a script context without HTML entity encoding, JavaScript string escaping, or a content security policy strong enough to block inline execution.

Attack Vector

An attacker crafts a URL targeting the p.rfihub.com component with a malicious payload placed in the ca parameter. The attacker distributes this URL through phishing, social media, or advertising channels. When the victim loads the URL, the server reflects the payload into the response and the browser executes it. Refer to the GitHub Reflected XSS Analysis for the proof-of-concept URL structure.

No verified code examples are published. See the GitHub Reflected XSS Repository for technical details.

Detection Methods for CVE-2026-79035

Indicators of Compromise

Inbound requests to p.rfihub.com containing <script>, javascript:, onerror=, or URL-encoded variants inside the ca parameter
Referrer headers from untrusted domains pointing to URLs with encoded payloads in the ca parameter
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting p.rfihub.com links

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ca parameter for XSS signatures including angle brackets, event handlers, and encoded script tags
Monitor web server access logs for anomalous query strings targeting the p.rfihub.com endpoint
Use browser telemetry and endpoint detection to flag script execution originating from marketing tracking domains

Monitoring Recommendations

Alert on Content Security Policy violation reports referencing the affected origin
Correlate email gateway detections of URLs containing p.rfihub.com with the ca parameter against user click telemetry
Track spikes in requests to the vulnerable component from unusual geographies or user agents

How to Mitigate CVE-2026-79035

Immediate Actions Required

Contact Zeta Global for guidance and apply any vendor-supplied hotfixes to the p.rfihub.com component
Block or filter inbound traffic containing suspicious payloads in the ca parameter at the WAF or reverse proxy layer
Warn users and security awareness teams about phishing lures that leverage marketing platform redirect URLs

Patch Information

No vendor advisory or patch URL is listed in the NVD entry at the time of publication. Review the external references and monitor Zeta Global communications for remediation guidance.

Workarounds

Enforce strict output encoding on the ca parameter, converting HTML metacharacters to their entity equivalents before rendering
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Configure the WAF to reject requests where the ca parameter contains HTML tags, JavaScript URI schemes, or event handler attributes
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based token theft

bash

# Example WAF rule (ModSecurity syntax) to block XSS payloads in the ca parameter
SecRule ARGS:ca "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe|<svg)" \
    "id:1002026,phase:2,deny,status:403,log,msg:'CVE-2026-79035 XSS attempt in ca parameter'"