PT-2026-2173 · Unknown · Opexus Ecase

Aaron M. Ramirez + 3 · Published 2026-01-08 · Updated 2026-01-09 · CVE-2026-22231

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eCASE versions prior to 11.14.1.0

Description OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. This JavaScript is executed when another user views the Action History Log. The issue is a stored cross-site scripting (XSS) condition. The vulnerable functionality is related to the Document Check Out feature and the ability to add comments.

Recommendations Update OPEXUS eCASE to version 11.14.1.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22231

Affected Products

Opexus Ecase

References · 8

• https://cve.org/CVERecord?id=CVE-2026-22231 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22231 · Security Note
• https://docs.opexustech.com/docs/eCase/11.14.X/eCASE_Release_Notes_11.14.1.0.pdf · Note
• https://twitter.com/VulmonFeeds/status/2009495531676991969 · Twitter Post
• https://twitter.com/CVEnew/status/2009462347199545429 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.json · Note
• https://t.me/CVEtracker/41750 · Telegram Post