Proof-of-Concept Exploit Released for Pre-Auth RCE Chain in Sitecore Experience Platform - NHS England Digital

Cyber alerts - NHS England Digital

Search Results - NHS England Digital

All controls on the page - including links, buttons, and fields - should show when 
they have been selected by the keyboard.

You can confirm this yourself by loading a webpage and using the Tab key to navigate 
through it. Anything you can select should alter its appearance when selected. 
For example, a text field might change color, or have a distinctive border applied. 

This is default behavior for all standard web controls, and so if this issue is appearing
it is because this default behavior has been disabled. Or alternatively, if you have written
your own custom controls, these will need styling to support focus states.

## How to fix

Links and form controls typically define an `outline` CSS style, which ensures
they are highlighted automatically, for example:

```css
input:focus (outline: 2px solid red);
``` 

If you choose to override or disable the default `outline`, you should specify an accessible 
alternative, such as a border or background color.

### Elements appear to change in the browser

Focus states should be defined in CSS alone, and not require JavaScript to work.

Try disabling JavaScript on the page, and see if focus is still visible. If it not,
then the focus state won't work with assistive technologies that don't have a physical
keyboard, e.g. mobile phones.

Some more unusual means of implementing a focus state cannot be detected or measured
automatically. These include:

* Focus implemented via pseudo-elements - such as `::after` or `::before`.
* Focus using `:focus-within` (JavaScript current provides no way to access these).
* Focus cascaded to child elements, e.g. a `<span>` inside an `<a>` tag. We detect
  some of these cases, but there are variations that we cannot detect.

Currently, there is no practical way to assess these focus states automatically.

### Unexpected elements are focusable

You may be surprised to see tags like `<div>` or `<span>` being shown as focusable.
If an element has a `tabindex` of 0 or higher, it becomes focusable. Any HTML tag can be made 
focusable in this way, this is so that custom controls (e.g. your own drop-down menus, or 
sliders) can support keyboard navigation. [Learn more about tabindex on MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/tabindex).

## Further reading

* [WCAG 2.4.7](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html)

	Title / URL	Issues
	Proof-of-Concept Exploit Released for Pre-Auth RCE Chain in Sitecore Experience Platform - NHS England Digitaldigital.nhs.uk/cyber-alerts/2025/cc-4672	4
	Cyber alerts - NHS England Digitaldigital.nhs.uk/cyber-alerts	3
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/overweight	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/contraception	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/lifestyle	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/lung-cancer	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/angina	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/gender	1
	Search Results - NHS England Digitaldigital.nhs.uk/search?query=&sort=date	1
	Search Results - NHS England Digitaldigital.nhs.uk/search/category/neonatal	1

Ensure controls change appearance when they are selected

NHS Digital

Where this issue has occurred