Quick answers
- Is CVE-2026-40464 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40464 being exploited in the wild.
- How severe is CVE-2026-40464?
- Medium severity, with a CVSS score of 5.4, published 31 August 2026.
- Which products and versions are affected?
- Nokia NSP <UNKNOWN>.
- Is there a fix for CVE-2026-40464?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-40464 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-40464?
- Check whether you run Nokia NSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw caused by insufficient validation and encoding of user-controlled input in NSP's workflow application component. An authenticated attacker can inject malicious JavaScript or HTML into workflow data that persists in the application database. When other users view the contaminated content, the malicious code executes in their browser context with the same permissions as the authenticated user. The vulnerability requires authentication and user interaction (viewing the crafted content), limiting its immediate impact but enabling session hijacking or data exfiltration attacks. Nokia has published a security advisory with the CVE identifier.
Affected products
- Nokia NSP <UNKNOWN>
Timeline
- 2026-08-31: disclosed