CVE-2026-66300

MEDIUM 5.0

SNOMED International Snowstorm reflected XSS

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.

CWE	CWE-79
Vendor	snomed international
Product	snowstorm
Published	Aug 4, 2026
Last Updated	Aug 4, 2026

Stay Ahead of the Next One

Get instant alerts for snomed international snowstorm

Be the first to know when new medium vulnerabilities affecting snomed international snowstorm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

SNOMED International / Snowstorm

7.0.0 < 10.12.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39 github.com: https://github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6 cve.org: https://www.cve.org/CVERecord?id=CVE-2026-66300 raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-212-01.json

Credits

Michael Milkovich, CISA Karl Meister, CISA