CVE-2026-40126: OutSystems Service Center DOM-based XSS Vulnerability Advisory

Vulnerability Overview CVE ID: CVE-2026-40126 Publication Date: August 17, 2026 Vendor: OutSystems Product: Service Center Affected Versions: All versions below 11.41.2 Vulnerability Type: Improper Neutralization of Input During Web Page Generation (CWE-79) Report Source: Reported to CERT Polska Description CERT Polska received a report regarding a vulnerability in OutSystems Service Center software and participated in coordinating its disclosure. This vulnerability, CVE-2026-40126, makes OutSystems Service Center susceptible to DOM-based Cross-Site Scripting (XSS) attacks. A low-privileged attacker can exploit this vulnerability by uploading a file containing a malicious filename (embedded with JavaScript code). The vulnerability exists in any location where files can be attached and prepared for upload to the server. Remediation This issue has been fixed in OutSystems Service Center version 11.41.2. Additional Information Credits: Thanks to Zbigniew Piotrak from the AFINE team for reporting the vulnerability. Coordinated Disclosure Process: More information about the coordinated vulnerability disclosure process can be found at http://cert.pl/en/cvd. CERT Polska: Is part of NASK - the National Research Institute, established in 1996 to respond to computer security incidents. It is one of the three teams comprising Poland's national cybersecurity system. Contact Information Address: Końska 12, 01-045 Warsaw, Poland Phone: +48 22 500 55 55 Email: [email protected] Incident Reporting: incident.cert.pl Social Media: Facebook, LinkedIn, GitHub Funding This page is co-funded by the European Union.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-40126: OutSystems Service Center DOM-based XSS Vulnerability Advisory