Is there a public PoC exploit available for EUVD-2026-43195?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43195. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording EUVD-2026-43195

Q: What is the CVSS score of EUVD-2026-43195?

EUVD-2026-43195 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-15473 LOW

Improper Authorization (CWE-285)

2026-07-12 VulDB

GHSA-g5qr-cxfc-7rp9

Authentication Bypass Call Recording Software Eleveo

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible endpoint requires low-privilege auth; improper authorization yields limited read/write impact on recordings, no availability or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 12, 2026 - 02:42 vuln.today

DescriptionCVE.org

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthorized operations on the Recorded Calls Page via the /callrec/restoreCallAction.do endpoint, potentially accessing or restoring call recordings outside their permitted scope. The vulnerability stems from CWE-285 (Improper Authorization), meaning the application fails to enforce access controls on the restore call action, permitting privilege escalation within the recording management interface. A publicly available proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric; no patch has been confirmed by the vendor, who did not respond to disclosure attempts.

Technical ContextAI

Eleveo Call Recording Software is an enterprise-grade contact center call recording and compliance platform (CPE: cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*). The vulnerable component is the Java-based web action handler restoreCallAction.do, a servlet-style endpoint under the /callrec/ context path responsible for managing the restore lifecycle of recorded calls. CWE-285 (Improper Authorization) indicates the endpoint either omits authorization checks entirely or performs them incorrectly - for example, verifying authentication but not whether the authenticated principal has rights to restore a specific recording object. This class of flaw is commonly exploited via direct object reference manipulation (sending a recording ID belonging to another user or department) or by invoking privileged restore actions from a low-privileged session.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. Organizations running Eleveo Call Recording Software 9.7.0 should apply the following compensating controls: restrict network access to the /callrec/restoreCallAction.do endpoint via WAF or reverse proxy ACL rules to prevent access from all but authorized administrative IP ranges (trade-off: may disrupt legitimate remote administration workflows); enforce role-based access control at the network perimeter by placing the call recording management interface on an isolated VLAN accessible only to supervisory roles; audit existing user accounts on the platform and remove or restrict any accounts with unnecessary access to the Recorded Calls Page; and monitor web server access logs for anomalous invocations of restoreCallAction.do from non-administrative user sessions. Contact Eleveo support directly referencing CVE-2026-15473 and VulDB entry https://vuldb.com/vuln/377778 to request a patched release or official guidance.