# CVE-2026-40126: DOM-based XSS in OutSystems Service Center via malicious file upload filenames

> CERT Polska coordinated the disclosure of CVE-2026-40126, a DOM-based cross-site scripting flaw (CWE-79, CVSS 4.0 base score 4.8) affecting all versions of OutSystems Service Center before 11.41.2. A low-privileged attacker can upload a file whose filename contains JavaScript code at any file-attachment point, and when that filename is rendered in the DOM it executes in the browser session of whoever views it. OutSystems shipped a fix in Service Center 11.41.2; no public PoC or active exploitation has been reported.

- **Published:** 2026-08-17T12:18:25Z
- **Last reviewed:** 2026-08-17T12:18:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2043
- **ID:** TL-2026-2043
- **Severity:** MEDIUM (CVSS 4.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-40126, CVE-2026-40127

## Description

OutSystems Service Center — the administration console for the OutSystems low-code platform — contains a DOM-based cross-site scripting vulnerability (CWE-79, Improper Neutralization of Input During Web Page Generation) tracked as CVE-2026-40126. Per the coordinated-disclosure advisory published by CERT Polska on 17 August 2026, a low-privileged authenticated attacker can exploit the flaw by uploading a file whose filename contains embedded JavaScript at any location in the application where a file can be attached and prepared for upload. The advisory states the vulnerability is present at 'all locations where a file can be attached and prepared for upload to the server,' but does not disclose the precise DOM sink or rendering path that turns the unsanitized filename into executed script — no proof-of-concept exploit has been published.

NIST's NVD record assigns a CVSS v4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N (base score 4.8, MEDIUM). The vector indicates the flaw is network-reachable and low-complexity, but requires the attacker to already hold low-level privileges (PR:L) and requires a second party's active interaction (UI:A) — consistent with a stored/DOM XSS where the payload only fires when another user (potentially a higher-privileged Service Center administrator) views the malicious filename in the UI. The explicit User Interaction: Active requirement means exploitation depends on a victim rendering or opening a file listing that contains the attacker-controlled filename, functionally an execution-through-interaction step rather than an unattended trigger. The Subsequent System (SC/SI) sub-scores of Low reflect that the resulting script execution can affect the confidentiality/integrity of the victim's browser session in Service Center, which functionally enables session-token theft and privilege escalation against whichever user renders the attacker-controlled filename.

The vulnerability was discovered and responsibly reported by Zbigniew Piotrak of the AFINE Team, a certified penetration-testing group with 150+ published CVEs, and coordinated to disclosure by CERT Polska. OutSystems remediated the issue in Service Center 11.41.2. This is the second OutSystems vulnerability from the same researcher/CERT Polska coordination pairing in 2026: CVE-2026-40127 (CWE-639, Authorization Bypass Through User-Controlled Key, in OutSystems LifeTime, fixed in 11.28.2.3955) was disclosed on 25 May 2026 and confirmed present in AFINE's own published research index alongside CVE-2026-40126 — a distinct flaw in a distinct OutSystems component, included here only as sourced context for the same research lineage, not as an affected product of this CVE. As of the advisory's publication date, CVE-2026-40126 is absent from CISA's Known Exploited Vulnerabilities catalog, consistent with CERT Polska's statement that no active exploitation or public PoC exists.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204 User Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking

## Sources

- [Vulnerability in OutSystems Service Center software](https://cert.pl/en/posts/2026/08/CVE-2026-40126/)
- [CVE-2026-40126 record](https://www.cve.org/CVERecord?id=CVE-2026-40126)
- [NVD CVE-2026-40126 Detail (CVSS v4.0, CWE-79)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-40126)
- [OutSystems vulnerability advisory (RPM-6669)](https://success.outsystems.com/support/security/vulnerabilities/vulnerability_rpm_6669/)
- [OutSystems LifeTime 11.28.2.3955 release notes (fix reference cited by NVD)](https://www.outsystems.com/downloads/ScreenDetails?ReleaseId=22953&MajorVersion=11&ComponentName=LifeTime)
- [AFINE Team research repository — CVE-2026-40126 and CVE-2026-40127 entries](https://github.com/afine-com/research)
- [AFINE — Certified Penetration Testing Team, 150+ CVEs Published](https://afine.com/about-afine)
- [AFINE Vulnerability Research index (lists CVE-2026-40127 alongside this research lineage)](https://afine.com/research)
- [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)
- [Vulnerability in Lifetime software (CVE-2026-40127, related AFINE Team/CERT Polska disclosure)](https://cert.pl/en/posts/2026/05/CVE-2026-40127/)
- [CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-40126 not listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2043