Threat reportVulnerabilityTL-2026-4547
CVE-2026-105987: Stored XSS in KGS Software tia Viewer annotation API (versions before 1.2.8)
CVE-2026-105987 (TL-2026-4547) is a medium-severity software vulnerability, first published 2026-10-27. It has no confirmed attribution, affects KGS Software tia Viewer, references 1 CVE (CVE-2026-105987), maps to 5 MITRE ATT&CK techniques (T1059.007, T1078, T1185), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4547
- Threat ID
- TL-2026-4547
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in CVE-2026-105987
Malware and tooling: KGS Software tia Viewer
How CVE-2026-105987 works
CERT Polska reports a stored cross-site scripting flaw (CWE-79) in the annotation API of KGS Software tia Viewer. An authenticated attacker can inject JavaScript into sticky note annotations, which executes in the browser of any user who opens the document, potentially compromising user sessions. Fixed in version 1.2.8.
CVE-2026-105987 is a stored (persistent) cross-site scripting vulnerability, classified CWE-79 (improper neutralization of input during web page generation), in the annotation API of KGS Software tia Viewer. The CERT Polska advisory (published 2026-10-27) states that an authenticated attacker can inject an arbitrary JavaScript payload into a stickynote annotation because input is not properly validated or sanitized. When other users subsequently open the annotated document, the payload executes in their browser, potentially compromising their sessions. All versions before 1.2.8 are affected; the issue is fixed in 1.2.8.
Context on the product: per KGS Software documentation, tia Viewer is a web-based viewer delivered as an OCI container image that lets SAP users view PDF, JPEG and TIFF documents retrieved from an ArchiveLink-certified SAP archive. Depending on configuration, users may add annotations that are stored alongside the document in the archive. This storage model is what makes the XSS persistent: the malicious annotation is saved with the document and replayed to every subsequent viewer.
Exploitation prerequisites and limits (from the advisory): the attacker must be authenticated and must have the ability to create annotations; the victim must open the affected document. The advisory does not provide a CVSS score, does not report in-the-wild exploitation, does not mention a public proof of concept, and lists no indicators of compromise. The severity_level of MEDIUM recorded here is an analyst-assigned placeholder reflecting an authenticated, user-interaction-required stored XSS; it is not a vendor or CERT rating. Downstream consumers should not assume active exploitation. The reporter is credited as Dawid Dudek (4c1d8urn), who reported directly to CERT Polska under its coordinated vulnerability disclosure policy. As of 2026-10-27 the CVE record page and an NVD API query returned no detailed data, so no additional CVSS/CPE enrichment was available.
MITRE ATT&CK techniques used in TL-2026-4547
Execution
T1059.007 Command and Scripting Interpreter: JavaScript
Persistence
Collection
T1185 Browser Session Hijacking
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in CVE-2026-105987
- KGS Software — tia Viewer
Vulnerable versions: all versions before 1.2.8
Fixed in: 1.2.8
Remediation for CVE-2026-105987
Patches
- tia Viewer 1.2.8 (fixed version per CERT Polska advisory)
Immediate actions
- Upgrade KGS Software tia Viewer to version 1.2.8 or later
- Review existing sticky note annotations stored with archived documents for embedded script content such as script tags or event-handler attributes
Workarounds
- Where annotations are enabled by configuration, restrict annotation creation to trusted users until the upgrade is applied
Longer-term hardening
- Deploy a restrictive Content-Security-Policy on the tia Viewer web origin to limit inline script execution
- Set session cookies HttpOnly, Secure and SameSite where configurable
- Subscribe to KGS Software and CERT Polska advisories for tia Viewer
CVEs associated with CVE-2026-105987
Weaknesses (CWE) in CVE-2026-105987
Timeline of CVE-2026-105987
- Advisory reports no in-the-wild exploitation, no public proof of concept and no indicators of compromise; exploitation requires an authenticated attacker able to create annotations plus a victim opening the document.
- NVD CVE API 2.0 and the CVE.org record page were queried at ingest and returned no detailed record, so no CVSS vector or CPE data was available.
- Threadlinqs assessment at ingest: no in-the-wild exploitation, public PoC or IOCs are reported in the advisory; NVD API returned no record for the CVE.
- Advisory credits Dawid Dudek (4c1d8urn), who reported the issue directly to CERT Polska under its coordinated vulnerability disclosure process; the report date is not stated.
- Advisory states all versions before 1.2.8 are affected and that 1.2.8 fixes the flaw; the vendor release date of 1.2.8 is not stated in the advisory.
- CVE-2026-105987 (CWE-79) referenced by CERT Polska as the identifier for the tia Viewer stored XSS; no CVSS score was provided.
- CERT Polska published its advisory 'Vulnerability in KGS Software tia Viewer software' describing a stored XSS in the annotation API.
Sources cited for CVE-2026-105987
- CERT Polska: Vulnerability in KGS Software tia Viewer software
- CVE Record: CVE-2026-105987
- CERT Polska Coordinated Vulnerability Disclosure Policy
- KGS Software documentation: tia Viewer (core)
- MITRE CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
- NVD CVE API lookup for CVE-2026-105987 (no record returned as of 2026-10-27)
Detection coverage for TL-2026-4547
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4547 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.