CVE-2026-109557 tianma-if CVE debrief

Who should care

Defenders responsible for EdgeEver installations, security teams, and developers should be aware of this vulnerability and take necessary actions to prevent exploitation. This includes verifying EdgeEver versions, restricting access to the desktop bridge session token, and monitoring for suspicious activity related to notebook names and memo titles. Operators, platform administrators, and vulnerability management teams should also prioritize patching and补偿

Why it matters

CVE-2026-109557 is a stored XSS vulnerability in EdgeEver that allows attackers to inject malicious scripts, potentially leading to unauthorized actions, session compromise, data tampering, or service disruption. Defenders should prioritize patching and verifying EdgeEver installations.

• Attackers can inject malicious scripts, potentially leading to unauthorized actions
• Compromise of user sessions through desktop bridge session token exploitation
• Data tampering or theft through injected scripts
• Potential disruption of EdgeEver services

Technical summary

The vulnerability exists in the setMemoDragPreview function of EdgeEver, allowing attackers to inject malicious scripts through notebook names or memo titles. The scripts are executed when a drag preview is accessed with a desktop bridge session token. This could lead to unauthorized actions, session compromise, data tampering, or service disruption. Defenders should prioritize verifying and patching EdgeEver installations to prevent exploitation, focusing on the setMemoDragPreview function and related tools like MCP create_notebook, rename_notebook, or create_memo.

Defensive priority

Defenders should prioritize verifying and patching EdgeEver installations to prevent exploitation.

Recommended defensive actions

• Verify EdgeEver version and apply patches if necessary
• Restrict access to the desktop bridge session token
• Monitor for suspicious activity related to notebook names and memo titles
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in EdgeEver versions up to 1.112.0. The CVE Program and NVD provide official records, while GitHub issues and commits offer additional context. Defenders should verify EdgeEver installations and review notebook names and memo titles for potential script injection. The desktop bridge session token's exposure and potential unauthorized actions should be assessed. Evidence limits suggest verifying up to 1.112.0 and checking for unusual activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.