CVE-2026-78414

Descrição

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator-s session token, resulting in Administrator Account Takeover. An attacker who controls an Nx server on the same network segment can set that server-s site name to a script payload, which executes when an administrator opens the -Merge with Another Site- dialog and the site selection list is displayed.Solution: Update to Nx Witness VMS version 6.1.3 or later.