The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

CVE-2026-18360 affects the IRIS web application version 2.4.26 and possibly other versions. The vulnerability is a stored cross-site scripting (XSS) flaw located in the custom attributes function of the application. Stored XSS allows attackers to inject malicious scripts that are persistently saved on the server and executed in the browsers of users who access the affected page. IRIS is a collaborative incident response platform used in digital forensics and incident response (DFIR) workflows. This type of vulnerability can lead to session hijacking, credential theft, or further lateral movement within an organization. The advisory was published by SBA Research and details are available on both NVD and GitHub. Organizations using IRIS should review the advisory and apply any available patches or mitigations promptly.