Quick answers
- Is CVE-2026-60043 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60043 being exploited in the wild.
- How severe is CVE-2026-60043?
- Critical severity, with a CVSS score of 9.3, published 10 November 2026.
- Which products and versions are affected?
- Helmholz myREX24V2 before 2.21.0; Helmholz myREX24V2.virtual before 2.21.0.
- Is there a fix for CVE-2026-60043?
- Yes: fixed in myREX24V2 firmware 2.21.0; myREX24V2.virtual firmware 2.21.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-60043 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-60043?
- Check whether you run Helmholz myREX24V2 or Helmholz myREX24V2.virtual at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: myREX24V2 firmware 2.21.0; myREX24V2.virtual firmware 2.21.0
Technical details
A stored or reflected cross-site scripting (CWE-79) vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of a logged-in backend user's session. The vulnerability requires user interaction (the logged-in user must visit a malicious link or page) but has network-wide impact (scope change). Successful exploitation enables execution of system commands such as server shutdown or backup restoration.
Affected products
- Helmholz myREX24V2 before 2.21.0
- Helmholz myREX24V2.virtual before 2.21.0
Timeline
- 2026-11-10: disclosed