Attack Chain

1. The attacker identifies a vulnerable endpoint within the Kaspersky Anti Targeted Attack Platform web application. This endpoint accepts user-controlled input without proper sanitization.
2. The attacker crafts a malicious URL or injects malicious code into a form field that will be processed by the vulnerable endpoint. This malicious code includes JavaScript or other client-side scripting languages.
3. The attacker delivers the crafted URL to a victim user, typically through phishing, social engineering, or by injecting the link into another part of the application.
4. The victim user clicks on the malicious link or interacts with the injected form.
5. The vulnerable endpoint processes the attacker-supplied input and embeds it into the HTML response without proper encoding or sanitization.
6. The victim’s web browser renders the HTML response, executing the attacker’s injected script.
7. The injected script executes within the security context of the victim’s browser, allowing the attacker to access cookies, session tokens, and other sensitive information.
8. The attacker uses the stolen information to hijack the victim’s session, deface the web application, or redirect the victim to a malicious website.

Impact

Successful exploitation of these XSS vulnerabilities (CVE-2026-28348, CVE-2026-28350) in Kaspersky Anti Targeted Attack Platform can lead to unauthorized access to sensitive data, including user credentials and internal system information. The impact ranges from defacement to complete account takeover. Since the vulnerability exists in a security product, successful exploitation severely undermines the security posture of affected organizations. The number of potential victims depends on the user base of the affected Kaspersky Anti Targeted Attack Platform installations.

Recommendation

• Upgrade Kaspersky Anti Targeted Attack Platform to version 7.1.7 or later to remediate CVE-2026-28348 and CVE-2026-28350 (see Kaspersky Security Bulletin 12430#260526).
• Implement a Web Application Firewall (WAF) with rules to detect and block common XSS attack patterns targeting the Kaspersky Anti Targeted Attack Platform web interface.
• If upgrading is not immediately feasible, consider implementing input validation and output encoding on the Kaspersky Anti Targeted Attack Platform web interface as a temporary mitigation.