CVE-2026-16969 describes a stored cross-site scripting (XSS) vulnerability in the IRIS web application, version 2.4.26 and possibly earlier versions. The vulnerability exists within the assets function of the application. Stored XSS allows attackers to inject malicious scripts that are persistently saved on the server and executed in the browsers of other users who access the affected page. DFIR-IRIS is an open-source incident response platform used by security teams. The vulnerability was disclosed by SBA Research and documented in a public advisory on GitHub. Exploitation could allow attackers to steal session tokens, perform actions on behalf of authenticated users, or conduct further attacks within the application. The issue highlights the importance of input sanitization in web-based security tooling.