CVE-2026-76178

CVE-2026-76178 is a stored Cross-Site Scripting flaw (CWE-79) in the notification template feature of the OCS Inventory NG web console (ocsreports), at the endpoint /ocsreports/?function=notification. An administrator can insert malicious HTML into a notification template; the content is stored and later rendered without sanitisation when other administrators open the template customisation view. The injected JavaScript then executes in the application's security context, allowing an attacker to hijack or compromise the sessions of other administrative users. Only deployments of OCS Inventory NG with administrative access to the console are affected, and exploitation requires both admin-level privileges to inject the payload and interaction from another admin viewing the template. There is currently no public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.3% (19th percentile), so no active exploitation is known.

What to do: No fixed version is given in the available data, so check the OCS Inventory project and the INCIBE advisory for the patched release and upgrade as soon as one is published. In the meantime, restrict notification-template editing to trusted administrators, sanitise or limit HTML input in templates, and limit access to the ocsreports console (e.g., management network or VPN only). Because payloads persist and fire on every admin who opens the template view, review administrative accounts and recent sessions for signs of compromise.