Update to eCase Audit v11.14.2.0 and eCase Platform v11.14.1.0.
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2026-22230 | CWE-863 Incorrect Authorization | 7.6 High |
OPEXUS eCASE Audit incorrect access control OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0. CISA SSVC — Exploitation: PoC · Automatable: No · Impact: Partial Vendor fix: Fixed in version 11.14.1.0. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-22231 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5.5 Medium |
OPEXUS eCASE Audit Document Check Out stored XSS OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user views the Action History Log. Fixed in OPEXUS eCASE Platform 11.14.1.0. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in version 11.14.1.0. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-22232 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5.5 Medium |
OPEXUS eCASE Audit Project Setup stored XSS OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 11.14.2.0. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-22233 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5.5 Medium |
OPEXUS eCASE Audit Project Cost stored XSS OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits the Project Cost tab. Fixed in OPEXUS eCASE Audit 11.14.2.0. CISA SSVC — Exploitation: None · Automatable: No · Impact: Partial Vendor fix: Fixed in 11.14.2.0. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2026-22230 | 7.6 High | OPEXUS eCASE Audit OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have … |
| CVE-2026-22231 | 5.5 Medium | OPEXUS eCASE Audit OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is ex… |
| CVE-2026-22233 | 5.5 Medium | OPEXUS eCASE Audit OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed … |
| CVE-2026-22232 | 4.8 Medium | OPEXUS eCASE Audit OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The Jav… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.