CVE-2026-5754 - Vulnerability Details - OpenCVE

Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Radware	Alteon

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.kb.cert.org/vuls/id/890999
https://www.radware.com/products/alteon/

History

Tue, 21 Apr 2026 17:30:00 +0000

Type	Values Removed	Values Added
References		https://www.kb.cert.org/vuls/id/890999

Tue, 21 Apr 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 17 Apr 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79

Fri, 17 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-79

Thu, 16 Apr 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Wed, 15 Apr 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Radware Radware alteon
Weaknesses		CWE-79
Vendors & Products		Radware Radware alteon

Tue, 14 Apr 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities.
Title		Radware Alteon has a reflected XSS vulnerability
References		https://www.radware.com/products/alteon/

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-04-14T17:51:12.616Z

Updated: 2026-04-21T16:25:02.461Z

Reserved: 2026-04-07T16:18:19.839Z

Link: CVE-2026-5754

Vulnrichment

Updated: 2026-04-21T16:25:02.461Z

NVD

Status : Awaiting Analysis

Published: 2026-04-14T18:17:39.487

Modified: 2026-04-21T17:16:57.940

Link: CVE-2026-5754

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5754", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-04-07T16:18:19.839Z", "datePublished": "2026-04-14T17:51:12.616Z", "dateUpdated": "2026-04-21T16:25:02.461Z"}, "containers": {"cna": {"title": "Radware Alteon has a reflected XSS vulnerability", "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Radware", "product": "Alteon vADC", "versions": [{"status": "affected", "version": "34.5.4.0"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "references": [{"url": "https://www.radware.com/products/alteon/"}], "x_generator": {"engine": "VINCE 3.0.35", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5754"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-14T17:52:21.871Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T11:43:25.734718Z", "id": "CVE-2026-5754", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:05:53.478Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/890999"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-21T16:25:02.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/890999"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-21T16:25:02.461Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-5754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T11:43:25.734718Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T11:43:13.739Z"}}], "cna": {"title": "Radware Alteon has a reflected XSS vulnerability", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Radware", "product": "Alteon vADC", "versions": [{"status": "affected", "version": "34.5.4.0"}]}], "references": [{"url": "https://www.radware.com/products/alteon/"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.35", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-5754"}, "descriptions": [{"lang": "en", "value": "Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions, data theft, or other malicious activities."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-04-14T17:52:21.871Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5754", "state": "PUBLISHED", "dateUpdated": "2026-04-21T16:25:02.461Z", "dateReserved": "2026-04-07T16:18:19.839Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-04-14T17:51:12.616Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}