Is Your Crafty Controller Audit Log Vulnerable to Stored XSS?

The short version

• Arcadia Technology’s Crafty Controller contains a severe output escaping vulnerability.
• The flaw resides in the Audit Logs component and enables stored cross-site scripting.
• No authentication is required for a remote attacker to trigger this exploit.

The details

The National Vulnerability Database lists CVE-2026-18516 as a critical issue with a CVSS score of 9.6. This rating reflects the high severity of the weakness, which stems from improper output escaping. The vulnerability is mapped to CWE-116, indicating that the software fails to correctly escape data before rendering it in the browser.

According to the NVD record, the flaw allows a remote, unauthenticated attacker to perform stored cross-site scripting. The attack vector involves HTTP header injection, meaning malicious code can be embedded in incoming request headers and subsequently stored within the application’s audit logs.

The context

Arcadia Technology, LLC produces the affected software, Crafty Controller. All versions up to 4.10.8 are confirmed to be vulnerable. The specific component at risk is the Audit Logs module, which is typically used for monitoring system activity and maintaining compliance records.

Because the attack requires no authentication, any system exposing this component to the internet or an untrusted network segment is at risk. The stored nature of the XSS means that once the malicious payload is injected, it persists in the logs until manually removed or the system is patched.

Next steps

Organisations using Crafty Controller should immediately verify their installed version. If the version is 4.10.8 or lower, the environment is considered exposed. Teams should check whether the Audit Logs component is accessible from untrusted networks.

The source material does not state whether a fix exists. Until an update is available, consider restricting access to the audit log interface. Monitor for unusual HTTP header patterns that might indicate an injection attempt.

What defenders should look for

Teams usually monitor web server access logs for anomalous HTTP headers containing script tags or encoded payloads. Check whether audit log entries display unexpected HTML or JavaScript content. Look for alerts from web application firewalls regarding header injection attempts. Investigate any sudden increase in log size or unusual user-agent strings. Contain potential compromises by isolating affected servers and reviewing recent log entries for malicious scripts.

What to do and how to stay safe: Crafty Controller

• Verify the installed version of Crafty Controller against the affected list.
• Restrict network access to the Audit Logs component to trusted IPs only.
• Monitor web server logs for unusual HTTP header content or injection attempts.
• Prepare to apply a vendor update once a patch becomes available.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Crafty Controller are affected by CVE-2026-18516?

All versions of Crafty Controller up to and including 4.10.8 are affected.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows remote, unauthenticated attackers to perform stored cross-site scripting.

What is the CVSS score for this flaw?

The National Vulnerability Database assigns a CVSS score of 9.6, rated as critical.