Crafty Controller Critical Stored XSS (CVE-2026-18516) Enables Remote Script Execution via HTTP Headers
A critical stored cross-site scripting flaw in Crafty Controller allows unauthenticated remote attackers to inject malicious scripts through HTTP headers.
Key points
- CVE-2026-18516 affects Crafty Controller versions up to 4.10.8.
- The flaw allows remote, unauthenticated access to execute stored XSS.
- The vulnerability is rated critical with a CVSS score of 9.6.
An attacker exploiting CVE-2026-18516 gains the ability to execute stored cross-site scripting payloads within the Crafty Controller application. To achieve this, the threat actor needs only remote network access to the vulnerable instance, as no authentication is required. This access vector allows adversaries to inject malicious code that persists within the Audit Logs component, potentially compromising any user who subsequently views those logs.
How it unfolded
- The vulnerability was assigned CVE-2026-18516 and rated as critical with a CVSS score of 9.6.
- The flaw was identified in the output escaping mechanisms of the Audit Logs component.
- Attackers can leverage HTTP header injection to trigger the stored cross-site scripting execution.
Who is affected
Organizations running Arcadia Technology, LLC Crafty Controller are vulnerable if they have not updated past version 4.10.8. The National Vulnerability Database records the issue as affecting all versions up to and including 4.10.8. Systems operating on these older releases are exposed to remote exploitation without the need for user credentials. Managed service providers and administrators must verify their current version status against this specific cutoff to determine exposure.
The fix
The source material does not confirm the availability of a patch or update for CVE-2026-18516. The NVD record lists affected versions up to 4.10.8 but does not state whether a remediation has been released. Administrators should monitor for official announcements from Arcadia Technology, LLC regarding software updates. Until a fix is confirmed, organizations should rely on network restrictions to limit exposure.
What made it possible
Stored cross-site scripting typically occurs when an application fails to properly escape or sanitize user-supplied data before rendering it in a web interface. In this scenario, the weakness lies in the handling of HTTP headers within the audit logging system. Attackers often exploit such output escaping failures to inject scripts that persist on the server. Teams usually assess whether logging components validate all input sources, including headers, to prevent code injection. This stage of an intrusion allows adversaries to plant persistent payloads that execute when legitimate users view the affected logs.
What to do and how to stay safe: Crafty Controller
- Verify the installed version of Crafty Controller to determine if it falls within the affected range up to 4.10.8.
- Monitor official channels from Arcadia Technology, LLC for the release of a security patch.
- Restrict network access to the Crafty Controller interface to reduce the attack surface for unauthenticated users.
- Review audit log viewing practices to understand potential exposure to malicious content once a fix is available.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-18516?
The National Vulnerability Database rates the severity as critical with a CVSS score of 9.6.
Which versions of Crafty Controller are affected?
All versions of Arcadia Technology, LLC Crafty Controller up to and including 4.10.8 are vulnerable.
Is authentication required to exploit this flaw?
No, the vulnerability allows remote, unauthenticated attackers to perform stored cross-site scripting via HTTP header injection.
