Vulnerability-Lookup

VA-26-077-01

Vulnerability from csaf_cisa - Published: 2026-03-19 14:47 - Updated: 2026-03-19 14:47

Summary

OPEXUS eComplaint and eCase multiple vulnerabilities

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: OPEXUS eComplaint and eCase contain multiple vulnerabilities. In the worst case, an unauthenticated attacker could take over any account with a known username.

Recommended Practices: Update to OPEXUS eCase and eComplaint 10.1.0.0.

Company Headquarters Location: United States

CVE-2026-32865

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
OPEXUS eComplaint <10.1.0.0 OPEXUS / eComplaint		<10.1.0.0	Vendor Fix
OPEXUS eCASE <10.1.0.0 OPEXUS / eCASE		<10.1.0.0	Vendor Fix

Fixed 2 products

Product	Identifier	Version	Remediation
OPEXUS eComplaint 10.1.0.0 OPEXUS / eComplaint		10.1.0.0	Vendor Fix
OPEXUS eCASE 10.1.0.0 OPEXUS / eCASE		10.1.0.0	Vendor Fix

CVE-2026-32866

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
OPEXUS eCASE <10.1.0.0 OPEXUS / eCASE		<10.1.0.0	Vendor Fix

Fixed 1 product

Product	Identifier	Version	Remediation
OPEXUS eCASE 10.1.0.0 OPEXUS / eCASE		10.1.0.0	Vendor Fix

CVE-2026-32867

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CWE-639 - Authorization Bypass Through User-Controlled Key

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
OPEXUS eComplaint <10.1.0.0 OPEXUS / eComplaint		<10.1.0.0	Vendor Fix

Fixed 1 product

Product	Identifier	Version	Remediation
OPEXUS eComplaint 10.1.0.0 OPEXUS / eComplaint		10.1.0.0	Vendor Fix

CVE-2026-32868

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
OPEXUS eComplaint <10.2.0.0 OPEXUS / eComplaint		<10.2.0.0	Vendor Fix
OPEXUS eCASE <10.2.0.0 OPEXUS / eCASE		<10.2.0.0	Vendor Fix

Fixed 2 products

Product	Identifier	Version	Remediation
OPEXUS eComplaint 10.2.0.0 OPEXUS / eComplaint		10.2.0.0	Vendor Fix
OPEXUS eCASE 10.2.0.0 OPEXUS / eCASE		10.2.0.0	Vendor Fix

CVE-2026-32869

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Known affected 2 products, the same list as for CVE-2026-32868

Fixed 2 products, the same list as for CVE-2026-32868

References

7 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://raw.githubusercontent.com/cisagov/CSAF/de…	external
https://www.cve.org/CVERecord?id=CVE-2026-32865	external
https://www.cve.org/CVERecord?id=CVE-2026-32866	external
https://www.cve.org/CVERecord?id=CVE-2026-32867	external
https://www.cve.org/CVERecord?id=CVE-2026-32868	external
https://www.cve.org/CVERecord?id=CVE-2026-32869	external

Acknowledgments

CISA Adam Rose

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "OPEXUS eComplaint and eCase contain multiple vulnerabilities. In the worst case, an unauthenticated attacker could take over any account with a known username.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Update to OPEXUS eCase and eComplaint 10.1.0.0.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-077-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
      }
    ],
    "title": "OPEXUS eComplaint and eCase multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-03-19T14:47:43Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.13.0+build.51"
        }
      },
      "id": "VA-26-077-01",
      "initial_release_date": "2026-03-19T14:47:43Z",
      "revision_history": [
        {
          "date": "2026-03-19T14:47:43Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.1.0.0",
                "product": {
                  "name": "OPEXUS eCASE \u003c10.1.0.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.0.0",
                "product": {
                  "name": "OPEXUS eCASE 10.1.0.0",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.2.0.0",
                "product": {
                  "name": "OPEXUS eCASE \u003c10.2.0.0",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.0.0",
                "product": {
                  "name": "OPEXUS eCASE 10.2.0.0",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "eCASE"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.2.0.0",
                "product": {
                  "name": "OPEXUS eComplaint \u003c10.2.0.0",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.0.0",
                "product": {
                  "name": "OPEXUS eComplaint 10.2.0.0",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.0.0",
                "product": {
                  "name": "OPEXUS eComplaint \u003c10.1.0.0",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.0.0",
                "product": {
                  "name": "OPEXUS eComplaint 10.1.0.0",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "eComplaint"
          }
        ],
        "category": "vendor",
        "name": "OPEXUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Rose"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-32865",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via \u0027ForcePasswordReset.aspx\u0027. An attacker who knows an existing user\u0027s email address can reset the user\u0027s password and security questions. Existing security questions are not asked during the process.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-03-03T15:52:17Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0008",
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0007",
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32865"
        }
      ],
      "release_date": "2026-03-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0007"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0007",
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "OPEXUS eComplaint and eCase insecure password reset"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Rose"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-32866",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user\u0027s full name is rendered. The attacker can run script in the context of a victim\u0027s session.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-03-03T15:53:18Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32866"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        }
      ],
      "release_date": "2026-03-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "OPEXUS eComplaint and eCase stored XSS via profile first and last name"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Rose"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-32867",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via \u0027Portal/EEOC/DocumentUploadPub.aspx\u0027. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:Y/T:P/2026-03-04T18:26:56Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0008"
        ],
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32867"
        }
      ],
      "release_date": "2026-03-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0007"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 10.1.0.0.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0007"
          ]
        }
      ],
      "title": "OPEXUS eComplaint unauthenticated file upload"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Rose"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-32868",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the \u0027My Information\u0027 screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim\u0027s session.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-03-03T15:53:56Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0004"
        ],
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32868"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        }
      ],
      "release_date": "2026-03-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OPEXUS eComplaint and eCASE XSS via my information"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Adam Rose"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2026-32869",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the \"Name of Organization\" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim\u0027s session when they visit the case information page.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:P/2026-03-03T15:54:17Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0004"
        ],
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32869"
        }
      ],
      "release_date": "2026-03-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0",
          "product_ids": [
            "CSAFPID-0005"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0",
          "product_ids": [
            "CSAFPID-0006"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-05T00:00:00Z",
          "details": "Fixed in 10.2.0.0.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "OPEXUS eComplaint and eCASE XSS via Name of Organization field"
    }
  ]
}

CVE-2026-32865 (GCVE-0-2026-32865)

Vulnerability from cvelistv5 – Published: 2026-03-19 15:47 – Updated: 2026-03-19 18:20

Title

OPEXUS eComplaint and eCase insecure password reset

Summary

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-03-03 15:52 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-32865

Impacted products

2 products

Vendor	Product	Version
OPEXUS	eComplaint	Affected: 0 , < 10.1.0.0 (custom) Unaffected: 10.1.0.0
OPEXUS	eCASE	Affected: 0 , < 10.1.0.0 (custom) Unaffected: 10.1.0.0

Date Public

2026-03-18 00:00

Credits

Adam Rose, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T18:19:53.389115Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T18:20:51.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "eComplaint",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.1.0.0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "eCASE",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.1.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Rose, CISA"
        }
      ],
      "datePublic": "2026-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via \u0027ForcePasswordReset.aspx\u0027. An attacker who knows an existing user\u0027s email address can reset the user\u0027s password and security questions. Existing security questions are not asked during the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-32865",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-03-03T15:52:17.008706Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T15:47:59.962Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "name": "url",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32865"
        }
      ],
      "title": "OPEXUS eComplaint and eCase insecure password reset"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-32865",
    "datePublished": "2026-03-19T15:47:59.962Z",
    "dateReserved": "2026-03-16T20:57:07.192Z",
    "dateUpdated": "2026-03-19T18:20:51.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32866 (GCVE-0-2026-32866)

Vulnerability from cvelistv5 – Published: 2026-03-19 15:48 – Updated: 2026-03-19 18:21

Title

OPEXUS eComplaint and eCase stored XSS via profile first and last name

Summary

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user's full name is rendered. The attacker can run script in the context of a victim's session.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-03-03 15:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://www.cve.org/CVERecord?id=CVE-2026-32866
https://raw.githubusercontent.com/cisagov/CSAF/de…

Impacted products

1 product

Vendor	Product	Version
OPEXUS	eCASE	Affected: 0 , < 10.1.0.0 (custom) Unaffected: 10.1.0.0

Date Public

2026-03-18 00:00

Credits

Adam Rose, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T18:21:35.776406Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T18:21:50.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "eCASE",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.1.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Rose, CISA"
        }
      ],
      "datePublic": "2026-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in a user profile. An authenticated attacker can inject parts of an XSS payload in their first and last name fields. The payload is executed when the user\u0027s full name is rendered. The attacker can run script in the context of a victim\u0027s session."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-32866",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-03-03T15:53:18.506702Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T15:48:17.289Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32866"
        },
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        }
      ],
      "title": "OPEXUS eComplaint and eCase stored XSS via profile first and last name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-32866",
    "datePublished": "2026-03-19T15:48:17.289Z",
    "dateReserved": "2026-03-16T20:57:12.860Z",
    "dateUpdated": "2026-03-19T18:21:50.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32867 (GCVE-0-2026-32867)

Vulnerability from cvelistv5 – Published: 2026-03-19 15:48 – Updated: 2026-03-19 18:22

Title

OPEXUS eComplaint unauthenticated file upload

Summary

OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-03-04 18:26 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-425 - Direct Request ('Forced Browsing')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-32867

Impacted products

1 product

Vendor	Product	Version
OPEXUS	eComplaint	Affected: 0 , < 10.1.0.0 (custom) Unaffected: 10.1.0.0

Date Public

2026-03-18 00:00

Credits

Adam Rose, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32867",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T18:22:10.035728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T18:22:21.300Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "eComplaint",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.1.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Rose, CISA"
        }
      ],
      "datePublic": "2026-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via \u0027Portal/EEOC/DocumentUploadPub.aspx\u0027. Users would see these unexpected files in cases. Uploading a large number of files could consume storage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-32867",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-03-04T18:26:56.899999Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-425",
              "description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T15:48:35.236Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "name": "url",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32867"
        }
      ],
      "title": "OPEXUS eComplaint unauthenticated file upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-32867",
    "datePublished": "2026-03-19T15:48:35.236Z",
    "dateReserved": "2026-03-16T20:57:29.387Z",
    "dateUpdated": "2026-03-19T18:22:21.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32868 (GCVE-0-2026-32868)

Vulnerability from cvelistv5 – Published: 2026-03-19 15:48 – Updated: 2026-03-19 18:22

Title

OPEXUS eComplaint and eCASE XSS via my information

Summary

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim's session.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-03-03 15:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://www.cve.org/CVERecord?id=CVE-2026-32868
https://raw.githubusercontent.com/cisagov/CSAF/de…

Impacted products

2 products

Vendor	Product	Version
OPEXUS	eComplaint	Affected: 0 , < 10.2.0.0 (custom) Unaffected: 10.2.0.0
OPEXUS	eCASE	Affected: 0 , < 10.2.0.0 (custom) Unaffected: 10.2.0.0

Date Public

2026-03-18 00:00

Credits

Adam Rose, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T18:22:41.316480Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T18:22:51.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "eComplaint",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.2.0.0"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "eCASE",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.2.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Rose, CISA"
        }
      ],
      "datePublic": "2026-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the \u0027My Information\u0027 screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered. The attacker can run script in the context of a victim\u0027s session."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-32868",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-03-03T15:53:56.478507Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T15:48:48.164Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32868"
        },
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        }
      ],
      "title": "OPEXUS eComplaint and eCASE XSS via my information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-32868",
    "datePublished": "2026-03-19T15:48:48.164Z",
    "dateReserved": "2026-03-16T20:57:55.705Z",
    "dateUpdated": "2026-03-19T18:22:51.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32869 (GCVE-0-2026-32869)

Vulnerability from cvelistv5 – Published: 2026-03-19 15:49 – Updated: 2026-03-19 18:23

Title

OPEXUS eComplaint and eCASE XSS via Name of Organization field

Summary

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the "Name of Organization" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim's session when they visit the case information page.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2026-03-03 15:54 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://raw.githubusercontent.com/cisagov/CSAF/de…
https://www.cve.org/CVERecord?id=CVE-2026-32869

Impacted products

2 products

Vendor	Product	Version
OPEXUS	eComplaint	Affected: 0 , < 10.2.0.0 (custom) Unaffected: 10.2.0.0
OPEXUS	eCASE	Affected: 0 , < 10.2.0.0 (custom) Unaffected: 10.2.0.0

Date Public

2026-03-18 00:00

Credits

Adam Rose, CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-19T18:23:01.187570Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-19T18:23:20.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "eComplaint",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.2.0.0"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "eCASE",
          "vendor": "OPEXUS",
          "versions": [
            {
              "lessThan": "10.2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.2.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Rose, CISA"
        }
      ],
      "datePublic": "2026-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of the \"Name of Organization\" field when filling out case information. An authenticated attacker can inject an XSS payload which is executed in the context of a victim\u0027s session when they visit the case information page."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2026-32869",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2026-03-03T15:54:17.816315Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-19T15:49:08.663Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json"
        },
        {
          "name": "url",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32869"
        }
      ],
      "title": "OPEXUS eComplaint and eCASE XSS via Name of Organization field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2026-32869",
    "datePublished": "2026-03-19T15:49:08.663Z",
    "dateReserved": "2026-03-16T20:58:00.591Z",
    "dateUpdated": "2026-03-19T18:23:20.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VA-26-077-01

CVE-2026-32865 (GCVE-0-2026-32865)

CVE-2026-32866 (GCVE-0-2026-32866)

CVE-2026-32867 (GCVE-0-2026-32867)

CVE-2026-32868 (GCVE-0-2026-32868)

CVE-2026-32869 (GCVE-0-2026-32869)

Tags

Sightings

Nomenclature

Related by attack behaviour