VulnSocial

CVE-2026-92976Disclosure

LOWCVSS 5.1 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being properly sanitised when another user, including administrative staff, views the affected profile. Successful exploitation could allow JavaScript code to be executed in the victim’s browser, access to information available within the session, or the performance of actions using the victim’s permissions.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-613

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-18: 2PoC Mentioned / Linked · 2026-09-18: 1Technical Details · 2026-09-18: 209-18
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • UNDERCODE TESTING@UndercodeUpdate
    PoC

    🚨 Critical Stored XSS Flaw Discovered in T-Systems TAO 20 (#CVE-2026-92976) + Video -Prediction: 📈 1 Positive | 📉 2 Negative https://undercodetesting.com/critical-stored-xss-flaw-discovered-in-t-systems-tao-20-cve-2026-92976-video/ Educational Purposes!

    Post summary

    The post announces a critical stored XSS vulnerability in T-Systems TAO 20 (CVE-2026-92976) and links to a blog post with a video demonstration. No patch, exploit tool, or active exploitation is mentioned in the text itself.

    0000038
    748 followersView on X
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEaviso | Cross-Site Scripting (XSS) almacenado en TAO 2.0 de #T_Systems #CVE CVE-2026-92976 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/cross-site-scripting-xss-almacenado-en-tao-20-de-t-systems #AvisosDeSeguridad #TI #CNA #0day

    Post summary

    The text is an INCIBE security warning announcing CVE-2026-92976, a stored XSS vulnerability in TAO 2.0 from T-Systems. It provides basic vulnerability and affected-product details but no PoC, exploit tool, active exploitation claim, or named remediation.

    00000108
    53 followersView on X

Explore more

Back to dashboard