# CVE-2026-11747: Seres Software syWEB reflected cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-11747-seres-software-syweb-reflected-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-11747 · Severity: medium · CVSS 6.1 · Published 2026-08-27

Seres Software syWEB is a web application framework used to build business web applications. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts into web pages viewed by users, potentially stealing session credentials, capturing user input, or redirecting users to fraudulent sites. The vendor has confirmed the product is no longer supported and will not receive patches.

Technologies: [Seres Software syWEB](https://junglewise.ai/threats/technologies/syweb). Vendors: [Seres Software](https://junglewise.ai/threats/vendors/seres-software).

## Quick answers

**Is CVE-2026-11747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11747 being exploited in the wild.

**How severe is CVE-2026-11747?** Medium severity, with a CVSS score of 6.1, published 27 August 2026.

**Which products and versions are affected?** Seres Software syWEB through 27082026.

**Is there a fix for CVE-2026-11747?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11747 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-11747?** Check whether you run Seres Software syWEB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected XSS vulnerability exists in Seres Software syWEB due to improper neutralization of user-supplied input during web page generation. An attacker can craft a malicious URL containing JavaScript code that, when clicked by a victim, executes in the context of the victim's browser session. No authentication is required, and the attack requires only that a user click a malicious link. An attacker can steal session cookies, perform actions on behalf of the user, or redirect to malicious content. Since the vendor confirmed the product is unsupported, no official patches are available; users should consider decommissioning the application or implementing compensating controls such as Web Application Firewalls.

## Affected products

- Seres Software syWEB through 27082026

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: advisory: CVE-2026-11747 published; vendor confirmed product is unsupported

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0932](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0932)

## Related threats

- [Seres syWEB observable discrepancy account footprinting](https://junglewise.ai/threats/cve-2026-11754-seres-syweb-observable-discrepancy-account-footprinting)
- [Seres Software syWEB reflected XSS](https://junglewise.ai/threats/cve-2025-8461-seres-software-syweb-reflected-xss)