CVE-2026-94387 Webkul CVE debrief

Who should care

Defenders responsible for Aureus ERP systems, particularly those with user roles that can edit tracked text fields or view the Chatter panel, should assess exposure and prioritize patching or applying workarounds.

Why it matters

CVE-2026-94387 is a stored cross-site scripting vulnerability in Aureus ERP before version 1.6.0 that allows users with permission to edit tracked text fields to inject malicious markup. Defenders should prioritize verifying exposure, applying patches or workarounds, and monitoring the Chatter panel for suspicious activity.

• Potential execution of malicious scripts in the context of other users.
• Possible injection of arbitrary markup in the Chatter panel.
• Required verification of user input and output encoding.
• Potential disruption of business operations through exploitation.

Technical summary

The vulnerability exists in the Chatter field-change log of Aureus ERP before version 1.6.0, where old_value and new_value entries are rendered without proper escaping. This allows users with permission to edit tracked text fields to inject malicious markup that executes when other users, including administrators, view the record's Chatter panel. The issue can be addressed by applying patches or workarounds, such as restricting editing of tracked text fields to trusted users and roles, and monitoring the Chatter panel for suspicious activity.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Recommended defensive actions

• Verify if the Aureus ERP system is using a version before 1.6.0 and prioritize patching to version 1.6.0 or later.
• Restrict editing of tracked text fields to trusted users and roles.
• Monitor the Chatter panel for suspicious activity or injected markup.
• Consider implementing additional security controls, such as input validation and output encoding.
• Perform a thorough review of the Chatter panel for any existing malicious markup.
• Ensure that all user input is properly validated and encoded.
• Track exceptions and retest remediated assets to confirm the effectiveness of the patch.

Evidence notes

The CVE record and source references provide details on the vulnerability, including its existence in versions before 1.6.0 and the fix in version 1.6.0. The vulnerability is a stored cross-site scripting issue in the Chatter field-change log of Aureus ERP. The fix in version 1.6.0 addresses this issue by properly escaping old_value and new_value entries. Evidence is limited to CVE and NVD details, so defenders should verify the Chatter panel for suspicious activity and ensure proper input validation and output encoding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.