Vulnerability · Published Feb 12, 2026 · Assigned by VulnCheck

CVE-2026-26234JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax

High 8.8

In plain English

A high-severity security flaw in JUNG Smart Visu Server from ALBRECHT JUNG GMBH & CO. KG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

Affected products (as reported)

Vendor	Product	Versions
ALBRECHT JUNG GMBH & CO. KG	JUNG Smart Visu Server	1.1.10501.0.9051.0.8321.0.830

Weakness: CWE-644 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Zero Science Lab Vulnerability Advisory third-party-advisory
VulnCheck Advisory: JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax third-party-advisory