CVE-2026-64970

CVE-2026-64970 is a stored XSS vulnerability in ATutor's registration path that allows unauthenticated attackers to inject malicious scripts and exfiltrate session cookies. The CVSS 5.1 rating of 'medium' is technically accurate by the vector's rules, but those rules assume remediation is possible. ATutor is end-of-life. There will be no patch. This single fact redefines the entire risk calculus. The vulnerability lives in an unauthenticated registration field — specifically the phone field in ATutor 2.2.4, though testing was limited to that single version. For abandoned software with unknown patch histories, treat untested versions as compromised by default. The disclosure explicitly states only one version was checked; the safe assumption is that the attack surface extends further. Stored XSS in registration is not a complex exploit. Attackers create an account, inject payload into a profile field, and wait for an administrator to view that profile. The session cookie captured in that view grants immediate access to ATutor's authenticated environment. But the exposure doesn't end at ATutor's walls. Educational LMS platforms issue sessions that may be trusted by broader campus infrastructure — student record systems, identity providers, certification databases. One stolen cookie can cascade into the institutional stack. EPSS scores this at 0.00336, a figure that often triggers deprioritization. That score reflects current exploitation activity against maintained software with available patches. Neither condition applies here. The probability of exploitation isn't static — it accumulates over time as the install base ages, institutional data behind the authentication wall grows richer, and defenders accept 'no patch available' as justification for inaction. Your action framework: First, treat any ATutor installation as a Category 1 exposure requiring immediate isolation or removal, independent of CVSS scoring. Second, audit what other systems trust ATutor sessions — if single sign-on or session reuse exists, the blast radius extends well beyond the LMS itself. Third, if removal isn't immediately feasible, implement compensating controls: disable new registrations, restrict administrative access to hardened endpoints, and monitor for new accounts created from unexpected IP ranges. Fourth, recognize that CVSS medium is a score designed for patchable vulnerabilities — it's the wrong metric for a permanent exposure in software that processes sensitive educational data. The 'medium' rating isn't telling you this is manageable. It's telling you the scoring system has exited the conversation.

Reviewed through automated stages and approved by a human before publication.