# CVE-2026-44924: Veritas InfoScale VIOM cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-44924-veritas-infoscale-viom-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-44924 · Severity: info · Published 2026-05-20

Veritas InfoScale Operations Manager (VIOM), a tool used for managing complex data center storage and server environments, is vulnerable to a cross-site scripting (XSS) flaw. This issue could allow an attacker to execute malicious scripts in the browser of a legitimate user who is logged into the management console. If exploited, this could lead to the theft of session cookies, unauthorized actions performed on behalf of the user, or the defacement of the management interface.

Technologies: [Veritas InfoScale Operations Manager](https://junglewise.ai/threats/technologies/infoscale-operations-manager). Vendors: [Veritas](https://junglewise.ai/threats/vendors/veritas).

## Quick answers

**Is CVE-2026-44924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44924 being exploited in the wild.

**How severe is CVE-2026-44924?** Informational severity, published 20 May 2026.

**Which products and versions are affected?** Veritas InfoScale Operations Manager 9.1.3.

**Is there a fix for CVE-2026-44924?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44924 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44924?** Check whether you run Veritas InfoScale Operations Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Veritas InfoScale Operations Manager (VIOM) 9.1.3 contains a cross-site scripting (XSS) vulnerability. While the specific vulnerable parameter or component within the web application is not detailed in the advisory, XSS typically occurs when the application fails to properly sanitize user-supplied input before including it in a web page. An attacker could exploit this by tricking a user into clicking a malicious link or visiting a compromised page, leading to the execution of arbitrary JavaScript in the context of the victim's session. This can be used to hijack sessions or perform unauthorized administrative actions. Users are advised to check for security bulletins from Veritas for patching information.

## Affected products

- Veritas InfoScale Operations Manager (VIOM) 9.1.3

## Timeline

- 2026-05-20: disclosed
- 2026-05-20: advisory

## References

- [https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766080&articleTitle=InfoScale_Operations_Manager_IOM_web_application_Security_Bulletin_for_CVE_2026_44923_CVE_2026_44924_and_CVE_2026_44925](https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766080&articleTitle=InfoScale_Operations_Manager_IOM_web_application_Security_Bulletin_for_CVE_2026_44923_CVE_2026_44924_and_CVE_2026_44925)
- [https://www.veritas.com/support/en_US/doc/120571566-166757640-0/viom_tot_v118836641-166757640](https://www.veritas.com/support/en_US/doc/120571566-166757640-0/viom_tot_v118836641-166757640)

## Related threats

- [Veritas InfoScale Operations Manager CSRF in VIOM web application](https://junglewise.ai/threats/cve-2026-44925-veritas-infoscale-operations-manager-csrf-in-viom-web-application)
- [Veritas InfoScale VIOM SQL injection privilege escalation](https://junglewise.ai/threats/cve-2026-44923-veritas-infoscale-viom-sql-injection-privilege-escalation)