VULNpocalypse

CVE-2026-66300: SNOMED International Snowstorm reflected XSS

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

SNOMED International Snowstorm contains a reflected XSS vulnerability within the “Web Route” redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.

Description quoted from the CVE record (assigned by cisa-cg, published 2026-08-04).

Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

How it can be exploited

Exploitable over the network with low attack complexity only when specific conditions are present needing no privileges and a user must take an action. Impact: confidentiality low, integrity low, availability low. CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-52869, GHSA-hc58-x27q-7xc8

VEDAS cluster: VEDAS:DARKVORTEX

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

4 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS
0.003
low predicted chance of attack
VEDAS
0.988
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
SNOMED International Snowstormfrom 7.0.0 before 10.12.210.12.2 is not affected; 10.9.3 is not affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 10.12.2.

Vendor guidance:

How to detect it

Nuclei template (active check)

Snowstorm - Cross-Site Scripting

SNOMED International Snowstorm before 10.12.2 (backported to 10.9.3) contains a reflected cross-site scripting vulnerability in the `/web-route` redirection endpoint. When the `uri` parameter does not start with the configured hosted prefix, the raw value is reflected unencoded inside an IllegalArgumentException error body, and an `Accept: text/html` request makes Spring serve that body as text/html, executing the injected markup in the victim’s browser.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /web-route?uri=vedasINJ%22%3E%3Csvg%3E); it decides using status, word matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-66300.yaml
Show the template (45 lines)
yaml
id: CVE-2026-66300

info:
  name: "Snowstorm - Cross-Site Scripting"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    SNOMED International Snowstorm before 10.12.2 (backported to 10.9.3) contains a reflected cross-site
    scripting vulnerability in the `/web-route` redirection endpoint. When the `uri` parameter does not start
    with the configured hosted prefix, the raw value is reflected unencoded inside an IllegalArgumentException
    error body, and an `Accept: text/html` request makes Spring serve that body as text/html, executing the
    injected markup in the victim's browser.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-66300&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=snowstorm&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    cvss-score: 2.3
    cve-id: CVE-2026-66300
    cwe-id: CWE-79
  metadata:
    verified: false
  tags: cve,cve2026,snowstorm,xss,reflected,unauth
http:
  - raw:
      - |
        GET /web-route?uri=vedasINJ%22%3E%3Csvg%3E HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'vedasINJ"><svg>'

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 400

CVE-2026-66300.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-66300 Snowstorm - Cross-Site Scripting. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-66300 Snowstorm - Cross-Site Scripting"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/web-route"; nocase; fast_pattern; content:"uri="; nocase; content:"svg"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-66300; reference:url,https://www.exploit.observer/?keyword=CVE-2026-66300&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=snowstorm&match=exact; sid:1077400; rev:1;)

CVE-2026-66300.rules on GitHub

References

Vendor advisories and patches

Exploits and technical analysis

  • url (third-party-advisory)

Other references

  • url (vdb-entry)

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.