Is CVE-2026-61728 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61728 being exploited in the wild.

How severe is CVE-2026-61728?

Critical severity, with a CVSS score of 9.9, published 30 October 2026.

Which products and versions are affected?

SOCFortress CoPilot before 0.1.76.

How is CVE-2026-61728 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61728?

Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61728: SOCFortress CoPilot stored cross-site scripting in alerts and cases

CVE-2026-61728 · Severity: critical · CVSS 9.9 · Published 2026-10-30

SOCFortress CoPilot is a security operations dashboard that consolidates alerts, incidents, and assets. Authenticated users can inject malicious HTML and JavaScript into alert comments and case fields, which executes when other users—including administrators—view the poisoned content. An attacker can steal authentication tokens, impersonate any user who views the alert, modify or delete incidents, and access data across multiple customer tenants.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-61728 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61728 being exploited in the wild.
How severe is CVE-2026-61728?: Critical severity, with a CVSS score of 9.9, published 30 October 2026.
Which products and versions are affected?: SOCFortress CoPilot before 0.1.76.
Is there a fix for CVE-2026-61728?: Yes: fixed in CoPilot 0.1.76 (all sinks); 0.1.70 (health-check repairs only). Until then: Restrict portal access to trusted users; disable or revoke tokens if an analyst or administrator has viewed untrusted alert or case content until upgrade is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61728 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61728?: Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CoPilot 0.1.76 (all sinks); 0.1.70 (health-check repairs only)

Restrict portal access to trusted users; disable or revoke tokens if an analyst or administrator has viewed untrusted alert or case content until upgrade is possible.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in multiple Vue components that render user-supplied HTML without sanitization: AlertComment.vue, SocCaseNote.vue, SocCaseItem.vue, SocCaseAssetsItem.vue, SocAlertAssetsItem.vue, and HealthcheckItem.vue. An authenticated attacker posts poisoned markup via POST /api/incidents/db_operations/alert/comment; when viewed, injected scripts execute in the browser with access to plaintext tokens stored in JavaScript memory, enabling account takeover of any viewer including administrators.

Affected products

SOCFortress CoPilot before 0.1.76

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.