CVE-2025-40587 HIGH

CVE-2025-40587

Vendor Siemens
Product Polarion V2404
Weakness CWE-79 · XSS
Published February 10, 2026
Last update February 10, 2026

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitrary JavaScript code be included in document titles. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by creating specially crafted document titles that are later viewed by other users of the application.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
February 10, 2026 Record updated