Is CVE-2026-108059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108059 being exploited in the wild.

How severe is CVE-2026-108059?

Informational severity, published 3 November 2026.

Which products and versions are affected?

AM Systems ALO Suite 25_09_15.03_35.

Is there a fix for CVE-2026-108059?

Yes: fixed in 26_04_15.03_10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108059 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108059?

Check whether you run AM Systems ALO Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108059: AM Systems ALO Suite stored XSS in delivery note functionality

CVE-2026-108059 · Severity: info · Published 2026-11-03

ALO Suite is a cloud-based business management application used by organizations to manage companies, invoices, inventory, and employee data. This vulnerability allows authenticated users to inject malicious JavaScript code into delivery note fields that executes when other users view those records, potentially enabling session hijacking, data theft, or unauthorized actions within their accounts.

Vendors: AM Systems.

Quick answers

Is CVE-2026-108059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108059 being exploited in the wild.
How severe is CVE-2026-108059?: Informational severity, published 3 November 2026.
Which products and versions are affected?: AM Systems ALO Suite 25_09_15.03_35.
Is there a fix for CVE-2026-108059?: Yes: fixed in 26_04_15.03_10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108059 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108059?: Check whether you run AM Systems ALO Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26_04_15.03_10

Technical details

A stored cross-site scripting (XSS) vulnerability exists in ALO Suite's delivery note functionality due to insufficient input sanitization and output encoding. The "ReferenceOtherParty" parameter in the '/Documents/DeliveryNotes/Edit/{id}' endpoint allows authenticated attackers to store JavaScript that executes in other users' browsers when they access the affected delivery note record, enabling arbitrary actions in the victim's session context.

Affected products

AM Systems ALO Suite 25_09_15.03_35

Timeline

2026-11-03: disclosed
2026-04: patched: Fixed in version 26_04_15.03_10

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.