CVE-2018-11059: RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability.

Security readout for executives and security teams

RSA Archer before 6.4.0.1 allowed an authenticated user to save malicious browser-executed content into trusted application data. When another user viewed that stored data, code could run inside Archer, risking sensitive data exposure and limited integrity or availability impact. Exposure is likely limited to organizations running RSA Archer versions earlier than 6.4.0.1. Risk is higher where many authenticated users can create or modify application data later viewed by privileged users. Treat this as a high-priority remediation for any still-running legacy Archer instance. The main business concern is trusted-user compromise leading to browser-side execution against other Archer users, potentially including higher-privileged staff. Mitigation focus: Upgrade RSA Archer to 6.4.0.1 or later, following vendor guidance.; Restrict Archer write access to trusted users until remediation is complete.; Review stored rich content or user-controlled fields for suspicious HTML or JavaScript..

Prepared

May 23, 2026, 09:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.