CVE-2026-18360 affects the IRIS web application version 2.4.26 and possibly other versions, exposing a stored cross-site scripting (XSS) vulnerability in the custom attributes function. Stored XSS vulnerabilities allow attackers to inject malicious scripts that are persistently saved on the server and executed in the browsers of other users who access the affected page. IRIS is a DFIR (Digital Forensics and Incident Response) collaborative platform, making this vulnerability particularly sensitive as it targets security professionals. The vulnerability was discovered and reported by SBA Research, as referenced in their public advisory repository on GitHub. Exploitation could allow attackers to steal session tokens, perform actions on behalf of authenticated users, or pivot further within incident response workflows. The issue has been assigned a high criticality rating. Users are advised to update to a patched version or apply mitigations as recommended by the vendor.