Vulnerability · Published Aug 17, 2026 · Assigned by CERT-PL

CVE-2026-40126DOM-based Cross-Site Scripting in OutSystems Service Center

Medium 4.8

In plain English

A medium-severity cross-site scripting in Service Center from OutSystems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server. This issue was fixed in OutSystems Service Center version 11.41.2

Affected products (as reported)

Vendor	Product	Versions
OutSystems	Service Center	0 – before 11.41.2

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/en/posts/2026/08/CVE-2026-40126/ third-party-advisory
https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime product
https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6669/ vendor-advisory