CVE-2026-1001Disclosure(domoticz / domoticz)

LOWCVSS 4.8 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for domoticz domoticz systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.

domoticz CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.vulncheck.com/advisories/domoticz-stored-xss-via-hardware-configuration-endpoint

Other references

https://www.domoticz.com/2026.1/

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

domoticz

Threat summary

Active exploitation appears in 1 classified signals
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-03-25); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

domoticz

Products

domoticz

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Active Exploitation

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-25	1	Disclosure1
2026-09-16	1	Active Exploitation1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc22d
Active Exploitation
TRC analysis shows attackers exploited CVE-2026-1001 in PaperCut servers during a 6-day patch window, then moved laterally through internal networks using harvested credentials. Runtime segmentation could have limited blast radius during the extended remediation period. #ZeroDay #ZeroTrust 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/papercut-zero-day-exploitation-august-2026-post-mythos-era
Post summary
The post reports that attackers actively exploited CVE-2026-1001 in PaperCut servers and used harvested credentials for lateral movement. It does not provide PoC, exploit tooling, patch specifics, or detailed technical vulnerability information.
0000068
2.0K followersView on X
CVE@CVEnew196d
Disclosure
CVE-2026-1001 Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allo… https://www.cve.org/CVERecord?id=CVE-2026-1001
Post summary
CVE-2026-1001 is a stored XSS flaw in Domoticz versions prior to 2026.1, impacting the Add Hardware and rename device features of the web interface.
00000111
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	domoticz	domoticz	-	-	-

Explore more

Back to dashboard domoticz CVEs domoticz vulnerabilities