CVE-2026-63147 Omnispace CVE debrief

Who should care

Defenders responsible for Agora Project installations, security teams, and administrators should be aware of this vulnerability and take necessary actions to prevent exploitation. This includes verifying exposure of Agora Project installations to this vulnerability and upgrading to version 26.10.0 or later. Inventory checks and monitoring for suspicious file uploads and user activity are recommended.

Why it matters

CVE-2026-63147 is a stored cross-site scripting vulnerability in Omnispace Agora Project before version 26.10.0. The vulnerability allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename. Defenders should prioritize verifying exposure of Agora Project installations to this vulnerability and upgrading to version 26.10.0 or later. Inventory checks and monitoring for suspicious file uploads and user activity are recommended. The corpus does not establish evidence of exploitation or specific victims, so verification of exposure and remediation is necessary.

• Potential script execution in browsers of other users
• Possible unauthorized access to user sessions
• Stealing of sensitive information
• Defacement of web pages or injection of malicious content

Technical summary

The vulnerability is caused by a lack of proper sanitization of uploaded file names, allowing authenticated users to inject malicious script. The script can be stored and later rendered to other users, resulting in script execution in their browsers. This issue affects Omnispace Agora Project versions before 26.10.0. Defenders should focus on verifying exposure and applying the necessary updates or mitigations. The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure of Agora Project installations to this vulnerability and upgrading to version 26.10.0 or later. Inventory checks and monitoring for suspicious file uploads and user activity are recommended.

Recommended defensive actions

• Verify Agora Project installations for exposure to this vulnerability
• Upgrade to version 26.10.0 or later
• Monitor for suspicious file uploads and user activity
• Implement additional security measures to prevent similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish evidence of exploitation or specific victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.