CVE-2021-35475: SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server.

Security readout for executives and security teams

CVE-2021-35475 is a stored cross-site scripting issue in SAS Environment Manager 2.5. A malicious value in a server Name field can later trigger script execution when Configuration Properties are edited. Business risk is concentrated around administrators using the management console, not unauthenticated internet-wide compromise based on the provided sources. Exposure is likely limited to organizations running SAS Environment Manager 2.5, especially where untrusted or lower-trust users can create or edit server records. Publicly exposed management consoles would raise concern, but the sources do not establish default exposure. Treat this as a targeted administrative-console risk. Prioritize if SAS Environment Manager 2.5 is still deployed, exposed beyond trusted administrators, or used in regulated data environments. No source in the bundle confirms active exploitation or a critical severity rating. Mitigation focus: Check SAS support guidance for affected builds, patches, or workarounds.; Restrict SAS Environment Manager access to trusted administrators and networks.; Review server names for unexpected markup or script-like content..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.