LiveActive security incident?Get immediate response
CVE Record

CVE-2026-0949: PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows u...

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the Manage Charts menu.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-0949 is a stored XSS flaw in EnterpriseDB Postgres Enterprise Manager before 9.8.1. A privileged user who can manage charts can save JavaScript in a chart. That script runs when users view the chart, potentially exposing sensitive data or enabling actions in the application context.

Executive priority

Treat as a near-term administrative application fix. It is not currently supported by sources as actively exploited, but it affects a privileged management tool and can compromise confidentiality and integrity inside PEM sessions.

Technical view

Affected PEM 9 versions prior to 9.8.1 allow stored cross-site scripting through chart creation in the Manage Charts menu. Default access is limited to the superuser and users with pem_admin or pem_super_admin privileges. CVSS 3.1 is 6.5 with high confidentiality and integrity impact, high privileges required, and no availability impact.

Likely exposure

Exposure is mainly PEM deployments running version 9 before 9.8.1 where administrative users can access Manage Charts. Risk is lower than public unauthenticated XSS because exploitation requires high privileges, but impact can be significant if admin sessions or sensitive PEM data are affected.

Exploitation context

No public source in the bundle reports active exploitation, and the CVE is not listed as KEV. Abuse requires an authenticated privileged user to create a malicious chart, after which the stored script executes for users who access that chart.

Researcher notes

The key constraint is privilege: default access to the vulnerable chart path is limited to superuser, pem_admin, or pem_super_admin. Validate affectedness by version and role exposure. Avoid assuming broader product impact beyond EnterpriseDB Postgres Enterprise Manager versions before 9.8.1.

Mitigation direction

  • Upgrade EnterpriseDB Postgres Enterprise Manager to version 9.8.1 or later.
  • Restrict Manage Charts access to only trusted administrative users.
  • Review pem_admin and pem_super_admin assignments for least privilege.
  • Check EnterpriseDB’s advisory for any additional vendor guidance.

Validation and detection

  • Inventory PEM instances and identify versions earlier than 9.8.1.
  • Confirm which users can access the Manage Charts menu.
  • Review existing custom charts for unexpected embedded script content.
  • After updating, verify PEM reports version 9.8.1 or later.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-0949 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N1.25.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2026-0949Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
EnterpriseDBPostgres Enterprise Manager (PEM)9affected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.