Overview
CVE-2026-60043 was published to the National Vulnerability Database on 2026-11-10 with a CVSS score of 9.3 (Critical). The NVD summary describes a cross-site scripting (XSS) flaw that an unauthenticated remote attacker can trigger against a logged-in backend user.
Because the injected script runs with the victim's administrative session, the attacker can drive privileged backend actions. The NVD description names two examples:
- Shutting down the server
- Restoring an uploaded backup
The stated impact is a loss of integrity and availability.
Why It Matters
Restoring an attacker-supplied backup is the more worrying path. It can overwrite configuration, accounts, and data with attacker-controlled content, and may lead to persistent compromise. The shutdown action is a straightforward denial of service.
The attack needs no credentials, but it does require a logged-in backend user to load the malicious content, so some user interaction is involved.
Information Gaps
The NVD entry available at publication did not name the vendor or product in the summary we reviewed. We could not confirm affected versions or fixed releases. Check the references on the NVD record and your vendor's advisory feed before acting.
Recommended Actions
- Read the NVD record and identify whether any product you run is the one affected.
- Apply the vendor patch as soon as one is available.
- Restrict backend and admin interfaces to trusted networks or a VPN.
- Have administrators log out of backend consoles when not in use and avoid browsing untrusted links while logged in.
- Deploy a strict Content-Security-Policy on the admin interface where possible.
- Restrict and audit backup-restore and shutdown functions, and alert on unexpected use.