How severe is CVE-2026-25688?

CVE-2026-25688 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-25688 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-25688?

CVE-2026-25688 affects Apache Answer. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-25688?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-25688 have an EU (EUVD) identifier?

Yes. CVE-2026-25688 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35367.

When was CVE-2026-25688 published?

CVE-2026-25688 was published on 2026-06-09 and last updated on 2026-06-17.

CVE-2026-25688

CVE-2026-25688 is a medium-severity vulnerability in Apache Answer with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-87.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-35367
Weakness: CWE-87
Affected product: Apache Answer
Published: 2026-06-09
Last modified: 2026-06-17

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Frequently asked questions

What is CVE-2026-25688?: Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
How severe is CVE-2026-25688?: CVE-2026-25688 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-25688 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-25688?: CVE-2026-25688 affects Apache Answer. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-25688?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-25688 have an EU (EUVD) identifier?: Yes. CVE-2026-25688 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35367.
When was CVE-2026-25688 published?: CVE-2026-25688 was published on 2026-06-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

Other CWE-87 vulnerabilities

CVE-2023-35158 — Critical (CVSS 9.6): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able…
CVE-2025-54369 — Critical (CVSS 9.3): Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML…
CVE-2026-55237 — High (CVSS 8.8): AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence…
CVE-2026-33510 — High (CVSS 8.8): Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been…
CVE-2026-33506 — High (CVSS 8.8): Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect.…
CVE-2026-40321 — High (CVSS 8.0): DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to…

Browse all CWE-87 vulnerabilities →