Vulnerability · Published May 20, 2026 · Assigned by VulnCheck

CVE-2026-9144Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface

High 7.6

In plain English

A high-severity cross-site scripting in AG1000-01A SMS Alert Gateway from Taiko Network Communications Pte Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions.

Affected products (as reported)

Vendor	Product	Versions
Taiko Network Communications Pte Ltd.	AG1000-01A SMS Alert Gateway	Rev 7.3Rev 8UM-AG1000_R7.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

References

Ledger Security Bulletin 019 technical-description
https://www.vulncheck.com/advisories/taiko-ag1000-01a-rev-8-stored-xss-via-web-configuration-interface third-party-advisory