PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32866 OPEXUS CVE debrief

CVE-2026-32866 is a stored XSS vulnerability in OPEXUS eComplaint and eCASE before version 10.2.0.0. The vulnerability occurs because the application does not properly sanitize the first and last name fields in a user's profile. An authenticated attacker can inject parts of an XSS payload into these fields. The payload is executed when the user's full name is rendered, allowing the attacker to run script in the context of a victim's session. This vulnerability has a CVSS score of 5.5 and a medium severity rating. According to the CVE record, the vulnerability was published on March 19, 2026.

Vendor
OPEXUS
Product
eCASE
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-19
Original CVE updated
2026-03-19
Advisory published
2026-03-19
Advisory updated
2026-03-19

Who should care

Security teams and administrators responsible for OPEXUS eComplaint and eCASE systems should be aware of this vulnerability. Specifically, those who manage user profiles or have access to the affected versions (before 10.2.0.0) should take immediate action to mitigate the risk. This vulnerability requires authentication and user interaction, but can lead to significant impact if exploited.

Technical summary

The vulnerability exists in OPEXUS eComplaint and eCASE versions before 10.2.0.0. The application fails to properly sanitize user input in the first and last name fields of a user's profile. An authenticated attacker can inject malicious script into these fields. When the victim's full name is displayed, the injected script is executed in the context of their session. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L, indicating a medium severity. The vulnerability was reported on March 3, 2026, and published on March 19, 2026.

Defensive priority

This vulnerability has a medium severity rating and requires authentication and user interaction. However, it can still pose a significant risk to affected systems. Security teams should prioritize patching or mitigating this vulnerability, especially in environments where user profiles are frequently updated or where users have elevated privileges.

Recommended defensive actions

  • Apply the vendor fix: Upgrade to OPEXUS eComplaint and eCASE version 10.2.0.0 or later.
  • Implement input validation and output encoding for user profiles.
  • Monitor user profile updates for suspicious activity.
  • Educate users about the risks of XSS and the importance of secure interactions with web applications.
  • Consider implementing a web application firewall (WAF) to detect and prevent XSS attacks.

Evidence notes

The CVE record and the source item from CISA provide detailed information about this vulnerability. The vulnerability was reported on March 3, 2026, and the CVE was published on March 19, 2026. The source item includes a detailed description of the vulnerability and the affected products. The CVE record provides additional context and references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32866 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32866

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32866 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32866

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-077-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.