PT-2026-2174 · Opexus · Opexus Ecase Audit

Aaron M. Ramirez + 3 · Published 2026-01-08 · Updated 2026-01-09 · CVE-2026-22232

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.2.0

Description OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the “A or SIC Number” field within the Project Setup functionality. This JavaScript is executed when another user views the project. The affected field is used for project setup and allows for the storage of malicious code. The A or SIC Number field is the entry point for this issue.

Recommendations Upgrade to OPEXUS eCASE Audit version 11.14.2.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22232

Affected Products

Opexus Ecase Audit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-22232 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-22232 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22232 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2009482732032708788 · Twitter Post
• https://twitter.com/CVEnew/status/2009462346335588462 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.json · Note
• https://docs.opexustech.com/docs/oig/audit/eCase_Audit_Release_Notes_11.14.2.0.pdf · Note
• https://t.me/CVEtracker/41751 · Telegram Post