PT-2026-26309 · Unknown · Opexus Ecomplaint

Adam Rose · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-32867

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPEXUS eComplaint versions prior to 10.1.0.0

Description An unauthenticated attacker can obtain or guess an existing case number and upload arbitrary files via the 'Portal/EEOC/DocumentUploadPub.aspx' endpoint. Uploading a large number of files could consume storage, and users would see these unexpected files in cases. The vulnerable parameter is the file uploaded through the specified endpoint.

Recommendations Update OPEXUS eComplaint to version 10.1.0.0 or later.

Fix

IDOR

Weakness Enumeration

CWE-425

CWE-639

Related Identifiers

CVE-2026-32867

Affected Products

Opexus Ecomplaint

References · 6

• https://cve.org/CVERecord?id=CVE-2026-32867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32867 · Security Note
• https://twitter.com/CVEnew/status/2036024200868286684 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034705898564735060 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json · Note
• https://twitter.com/cyberbivash/status/2034677171021554157 · Twitter Post