CVE-2026-22232: OPEXUS eCASE Audit Project Setup stored XSS
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22232?
CVE-2026-22232 is considered a high-severity vulnerability due to its ability to allow an authenticated attacker to save and execute JavaScript code.
How do I fix CVE-2026-22232?
To fix CVE-2026-22232, upgrade to OPEXUS eCASE Audit version 11.14.2.0 or later.
Who is affected by CVE-2026-22232?
CVE-2026-22232 affects users of OPEXUS eCASE Audit versions prior to 11.14.2.0.
What kind of attacks can CVE-2026-22232 facilitate?
CVE-2026-22232 can facilitate cross-site scripting (XSS) attacks as a result of the ability to save and execute malicious JavaScript.
Is there a workaround for CVE-2026-22232 if I can't upgrade immediately?
For users unable to upgrade, it is recommended to limit user permissions and restrict access to the Project Setup functionality.