PT-2026-2213 · Ideagen · Ideagen Devonway

Fernando Martinez + 3 · Published 2026-01-08 · Updated 2026-01-09 · CVE-2026-22587

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ideagen DevonWay versions prior to 2.62.4 Ideagen DevonWay version 2.62 LTS

Description Ideagen DevonWay contains a stored cross-site scripting issue. An authenticated attacker can create a malicious payload within the 'Reports' page. This payload will execute when another user views the report. The vulnerable component is the 'Reports' page.

Recommendations Update Ideagen DevonWay to version 2.62.4 or later. Update Ideagen DevonWay to version 2.62 LTS or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22587

Affected Products

Ideagen Devonway

References · 6

• https://cve.org/CVERecord?id=CVE-2026-22587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22587 · Security Note
• https://twitter.com/CVEnew/status/2009462349078671579 · Twitter Post
• https://t.me/CVEtracker/41755 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-03.json · Note
• https://twitter.com/VulmonFeeds/status/2009485292021969142 · Twitter Post