CVE-2026-61728: Stored XSS in SOCFortress CoPilot

CVE-2026-61728 is a stored Cross-Site Scripting (XSS) vulnerability in SOCFortress CoPilot, a central security operations platform. The flaw exists in the POST /api/incidents/db_operations/alert/comment endpoint where user-submitted comments are not sanitized before storage in the database. When another user—analyst, administrator—views the alert containing malicious code, the script executes in the application context and can intercept authentication tokens stored in JavaScript-accessible storage, stealing both access and refresh tokens.

The CVSS 9.9 score reflects critical impact: stolen tokens enable persistent impersonation via /auth/refresh and cross-tenant access. If the victim is an administrator or analyst, damage extends to incident modification and threat response subversion. Published on NVD 30 October 2026; public active exploits not confirmed, but risk is concrete for unpatched deployments.

The immediate priority is to verify SOCFortress CoPilot version in use and upgrade to 0.1.76 or later, which contains all fixes. Earlier versions like 0.1.70 are only partially protected for the health-check field but remain vulnerable to XSS via comment and other SOC fields. Beyond patching, audit alerts and cases modified in recent weeks to identify suspicious comments or field changes; if analyst or admin users have viewed unusual content, consider resetting authentication tokens as a precautionary mitigation against persistent account takeover.