Agentis CVE-2026-87752

Exploitation requires user interaction: a legitimate Agentis user must load attacker-controlled input that is reflected/rendered into an HTML attribute context in a generated web page (UI:R in the CVSS vector). No authentication is required of the attacker (PR:N), and the vector is network-reachable with low complexity, but the dependency on tricking a victim into opening a crafted link/input is the key limiting factor. Affected deployments are Agentis versions from 4.44 up to (not including) 4.6; upgrading to 4.6 removes exposure. Impact is bounded to the victim's browser session (C:L/I:L, no availability impact).

This is a reflected/attribute-context cross-site scripting flaw (CWE-79) with a vendor CVSS 3.1 base of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vector indicates network-reachable, low-complexity, unauthenticated exploitation (PR:N) but requires user interaction (UI:R), which is the primary limiting factor - a victim must be induced to load a crafted URL/input. Scope is changed (S:C) because injected script executes in the victim's browser context, with low confidentiality and integrity impact and no availability impact, consistent with typical XSS. On the real-world-risk signals: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The only intelligence source is a TR-CERT advisory (tr-26-1198); there is no independent NVD enrichment, EPSS probability, or SSVC decision data to corroborate exploitability. Net: this is a moderate-severity XSS in a narrowly-deployed product - a genuine but not high-priority issue. The CVSS network vector and description are consistent (no conflict); the main uncertainty is the total absence of exploitation-likelihood telemetry (EPSS/KEV/POC all missing), which should be treated as 'no evidence of exploitation' rather than 'low risk confirmed.'

An attacker crafts input that breaks out of an HTML attribute context in an Agentis web page and delivers a malicious link or form to a legitimate user of the application. When the victim opens it (UI:R), the injected script runs in their authenticated browser session, enabling session/cookie theft, UI manipulation, or actions on the victim's behalf. No public proof-of-concept is referenced, so exploitation would require an attacker to independently develop the payload.