Security readout for executives and security teams
Plain-English summary
An authenticated OPEXUS eCASE Audit user can save JavaScript in a Document Check Out comment. That script runs when another user opens the Action History Log. This is stored cross-site scripting, which can expose or alter data within the victim’s session. The issue is reported fixed in eCASE Platform 11.14.1.0.
Executive priority
Treat as a moderate-priority application security fix. It requires an authenticated user and victim interaction, but it can affect sensitive case workflows if abused. Prioritize remediation for production systems with broad user access or sensitive audit data.
Technical view
CVE-2026-22231 is CWE-79 stored XSS in OPEXUS eCASE Audit Document Check Out comments. CVSS 3.1 is 5.5: network reachable, low complexity, low privileges required, and user interaction required. Impact is limited confidentiality, integrity, and availability. The source bundle states the fix is in OPEXUS eCASE Platform 11.14.1.0.
Likely exposure
Exposure is mainly for organizations running OPEXUS eCASE Audit where authenticated users can use Document Check Out comments and other users view Action History Logs. Internet exposure is not required, but network access and a valid account are.
Exploitation context
No source provided indicates active exploitation, and this CVE is not listed as KEV in the bundle. Exploitation requires an authenticated attacker to store malicious script content and a separate user to view the affected Action History Log.
Researcher notes
Version data in the bundle is somewhat ambiguous: it lists versions including 11.14.1.0 while the description says 11.14.1.0 fixes the issue. Rely on OPEXUS release notes or support for final version scoping. Avoid assuming public exploit availability from the provided sources.
Mitigation direction
- Upgrade to OPEXUS eCASE Platform 11.14.1.0 if applicable.
- Review OPEXUS release notes and support guidance for exact affected versions.
- Restrict Document Check Out/comment permissions to trusted users where possible.
- Monitor Action History Log entries for suspicious script-like content.
- Clear or sanitize unsafe historical comments per vendor guidance.
Validation and detection
- Inventory OPEXUS eCASE Audit deployments and record platform versions.
- Confirm whether each deployment is on 11.14.1.0 or later.
- Review roles allowed to create Document Check Out comments.
- Inspect recent Action History Log comments for suspicious markup or script content.
- Use vendor-approved testing to confirm stored XSS is no longer present.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22231 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L2.13.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- urlCVE reference · release-notes
- urlCVE reference · government-resource, third-party-advisory
- urlCVE reference · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.