EUVD-2026-27856
GHSA-rx97-pwc5-6v32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate to ECE with Agent credentials
-
DeliveryNavigate to Lite Agent file upload
-
ExploitCraft HTML/script payload
-
InstallUpload malicious file
-
C2Other agents access uploaded file
-
ExecuteMalicious script executes in victim browser
-
ImpactSession hijacking or credential theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File extension validation
|
| Exploitation Conditions | Attacker must possess valid credentials for a Cisco ECE user account with at least Agent role privileges. The Lite Agent feature must be enabled in the ECE deployment. File upload functionality for the Lite Agent must be accessible to the authenticated attacker. The uploaded files must be served by the application to other users without content-type validation or script execution restrictions. Exploitation is limited to the scope of the ECE application (no cross-domain impact per CVSS S:U) and does not require tricking victims into clicking malicious links or downloading files-accessing the file in the ECE interface triggers the XSS. |
| Impact | CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates low-to-moderate severity with network accessibility but requiring authenticated access at the Agent level. While EPSS score is not provided, the attack vector (network-accessible), low attack complexity, and lack of user interaction on the victim side suggest reasonable real-world exploitability within organizations using ECE. The requirement for valid Agent credentials significantly limits the attacker pool compared to unauthenticated vulnerabilities, but compromised agent accounts or insider threats represent credible attack scenarios. The stored XSS nature of the vulnerability means impact is sustained and affects multiple users. Lack of KEV status or public POC at time of analysis suggests this is not currently being widely exploited in the wild, but the straightforward nature of file upload XSS attacks means reliable exploitation code could be trivially developed. The integrity-only impact (no confidentiality or availability loss) further supports classification as moderate risk rather than critical. |
| Exploit ScenarioDerived | An attacker with valid Agent credentials in Cisco ECE logs in and uploads an HTML file containing JavaScript code (e.g., session cookie stealing or phishing redirects) to a shared file area accessible to other agents. When other agents access or preview the uploaded file, the malicious script executes in their browser within the ECE application context, allowing credential theft or session hijacking. No user interaction is required beyond normal file access workflows. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 06, 2026
Cisco Enterprise Chat and Email (ECE) Lite Agent feature allows authenticated remote attackers with Agent role credentials to upload files containing malicious scripts or HTML, which are then served to other users without adequate content validation. Successful exploitation enables stored cross-site scripting (XSS) attacks in victim browsers. The vulnerability requires valid user credentials and Agent role privileges but no user interaction on the victim side, affecting confidentiality and integrity but not availability.
RemediationAI
Obtain and deploy the patched version of Cisco ECE from Cisco, with specific version information available in the official Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ece-lite-agent-BCgSN8eb. As an interim compensating control, restrict file upload functionality in the Lite Agent feature to authenticated administrators only, or disable the Lite Agent feature entirely if not operationally critical. Additionally, implement Content Security Policy (CSP) headers to restrict script execution from uploaded content, configure the application to serve uploaded files with 'Content-Disposition: attachment' headers to prevent in-browser execution, and audit file uploads to the Lite Agent feature for suspicious HTML or script content. Note that disabling Lite Agent may impact user functionality, so coordinate with business stakeholders before implementing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the file upload handling mechanism of the Lite Agent feature within ECE, specifically in the absence of proper file content validation and sanitization during upload operations. CWE-646 (Reliance on File Contents to Identify File Type) indicates the application trusts file contents without proper validation, allowing an attacker to upload HTML or script files that the application subsequently serves to other users. The combination of inadequate input validation and lack of output encoding creates a stored XSS condition where malicious payloads persist in the application and execute in the context of users accessing the uploaded files.
Know when Cisco Enterprise Chat And Email gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent.
This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB