CVE-2026-66300: Snomed International Snowstorm

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.

Affected products

• Snomed International Snowstorm: from 7.0.0, before 10.12.2 (fixed in 10.12.2)

Published 2026-08-04. Last modified 2026-08-26.