CVE-2026-66300

Medium

Description

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.

SeverityMedium

CVSS5.0

Exploit probability—

ProductSnowstorm

PublishedAug 4, 2026

First seenAug 4, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

SNOMED International Snowstorm10.12.2 or later

Patches

github.com/IHTSDO/snowstorm/commit/575b555695811110dafe2fcea7dd2fd7e4bcee39
github.com/IHTSDO/snowstorm/commit/b8061add427c930b3030549e77aa23ec5957ceb6

Affected products

Product	Affected versions	Fixed in
SNOMED International Snowstorm	7.0.0 ≤ v < 10.12.2	10.12.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.