CVE-2021-36450: Verint Workforce Optimization reflected XSS in NEWUINAV parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityReflected XSS requires user interaction and authentication to cause real impact, but public exploit code and a very high EPSS score raise the likelihood of attempts.

What it is

Verint Workforce Optimization 15.2.8.10048 reflects the control/my_notifications NEWUINAV parameter without adequate output encoding, allowing reflected cross-site scripting. An attacker who can lure a logged-in user to a crafted URL can execute script in that user's session context. The record names only one version and gives no fix version.

Impact

An attacker can run arbitrary JavaScript in a victim's authenticated WFO session, enabling session theft, credential or data exfiltration, or actions performed as the victim. The CVSS scope change (S:C) means impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL to the control/my_notifications endpoint with a malicious NEWUINAV value. No authentication is required to deliver the payload, but the victim must be authenticated to WFO and must interact by opening the link.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.64294 (99.19th percentile) and two references are tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Apply the vendor's patched WFO release; the record names only 15.2.8.10048, so confirm the fixed version with Verint.
• If no patch is available, restrict network access to the control/my_notifications endpoint to trusted users and networks.
• Deploy WAF or input-filtering rules that block script payloads in the NEWUINAV parameter.
• Set session cookies HttpOnly and SameSite to limit script-based session theft.
• Encode or validate the NEWUINAV parameter server-side before rendering it.

Detection

• Search web and proxy logs for requests to control/my_notifications containing script tags, event handlers, or encoded payloads in NEWUINAV.
• Alert on outbound requests or referrers from WFO sessions to unfamiliar external domains.
• Monitor for anomalous authenticated WFO actions or session reuse following a crafted-link click.
• Review WAF alerts for XSS signatures targeting the NEWUINAV parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.