VulnerabilityAnalyzed

CVE-2026-22232

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality.

MEDIUM 4.8EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.

CVSS 4.0: 4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: opexustech/ecase audit
Source: 9119a7d8-5eab-497f-8521-727c672e3725

References

https://docs.opexustech.com/docs/oig/audit/eCase_Audit_Release_Notes_11.14.2.0.pdfRelease Notes
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.jsonBroken Link
https://www.cve.org/CVERecord?id=CVE-2026-22232Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.