Critical Stored XSS Flaw Found in Crafty Controller Audit Logs
A remote, unauthenticated attacker can execute stored cross-site scripting via header injection in Arcadia Technology’s Crafty Controller software.
Key points
- CVE-2026-18516 carries a CVSS score of 9.6, rated as critical severity.
- The vulnerability exists in the Audit Logs component of Crafty Controller.
- Versions up to and including 4.10.8 are affected by this output escaping flaw.
The National Vulnerability Database has published CVE-2026-18516, identifying a critical security flaw in Arcadia Technology LLC’s Crafty Controller. This vulnerability allows a remote attacker to perform stored cross-site scripting without needing authentication credentials. The issue stems from improper output escaping within the application’s Audit Logs component.
At a glance
- CVE
- CVE-2026-18516
- Product
- Arcadia Technology, LLC Crafty Controller
- CVSS
- 9.6 Critical
- Weakness
- CWE-116
- Exploited
- No known exploitation
According to the NVD record, the flaw enables attackers to inject malicious scripts via HTTP header injection. The CVSS base score is 9.6, which classifies the threat as critical. This high severity rating is explicitly stated in the source material. The vulnerability is categorized under CWE-116, referring to improper encoding or escaping of output.
Technical Details and Context
The vulnerability is categorized under CWE-116, which refers to improper encoding or escaping of output. In this specific case, the failure to properly escape data in the Audit Logs allows for stored cross-site scripting. Attackers can leverage HTTP header injection to deliver this malicious payload. The NVD description explicitly states that the attacker is remote and unauthenticated.
This means an adversary does not need valid login credentials to exploit the flaw. They can target the Audit Logs component directly. The source material describes the vulnerability as allowing a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection. No further details on the persistence or impact on other users are provided in the record.
Affected Software Versions
Arcadia Technology LLC is the vendor responsible for the affected software, Crafty Controller. The NVD record specifies that all versions up to 4.10.8 are vulnerable to CVE-2026-18516. This includes version 4.10.8 itself, as well as any earlier releases. Organizations using these versions should assume their systems are at risk until a patch is confirmed.
There is no mention in the source material of a fixed version being released. Consequently, users running version 4.10.8 or older remain exposed to this critical vulnerability. The lack of a confirmed fix in the current data means administrators must rely on mitigation strategies or vendor updates that have not yet been documented in this record.
What should you do?
Security teams should immediately inventory their environments to identify any instances of Crafty Controller. If the installed version is 4.10.8 or lower, the system is considered vulnerable. Administrators should monitor official channels from Arcadia Technology for patch announcements. Until a fix is available, restricting network access to the Audit Logs component may reduce exposure.
What to do and how to stay safe: Crafty Controller
- Audit your network to locate all installations of Crafty Controller and verify their version numbers against the affected list.
- Restrict external access to the Crafty Controller interface, particularly the Audit Logs component, using firewalls or access control lists.
- Monitor system logs and network traffic for unusual HTTP header activity that could indicate an exploitation attempt.
- Subscribe to vendor security advisories to receive immediate notification when a patched version of Crafty Controller becomes available.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-18516?
The vulnerability has a CVSS score of 9.6, which is rated as critical severity according to the National Vulnerability Database.
Which versions of Crafty Controller are affected?
All versions of Crafty Controller up to and including version 4.10.8 are affected by this output escaping vulnerability.
Can an attacker exploit this flaw without logging in?
Yes, the NVD record states that a remote, unauthenticated attacker can perform stored cross-site scripting via this vulnerability.
