MEDIUM
Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
Published May 6, 2026
4.3
MEDIUMCVSS 3.1
EPSS 0.13%
Description
A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.
Affected products
-
- Version 11.5(1)StatusaffectedConstraints-
- Version 11.6(1)StatusaffectedConstraints-
- Version 11.6(1)_ES10StatusaffectedConstraints-
- Version 11.6(1)_ES11StatusaffectedConstraints-
- Version 11.6(1)_ES12StatusaffectedConstraints-
- Version 11.6(1)_ES12_ET1StatusaffectedConstraints-
- Version 11.6(1)_ES2StatusaffectedConstraints-
- Version 11.6(1)_ES3StatusaffectedConstraints-
- Version 11.6(1)_ES4StatusaffectedConstraints-
- Version 11.6(1)_ES5StatusaffectedConstraints-
- Version 11.6(1)_ES6StatusaffectedConstraints-
- Version 11.6(1)_ES7StatusaffectedConstraints-
- Version 11.6(1)_ES8StatusaffectedConstraints-
- Version 11.6(1)_ES9StatusaffectedConstraints-
- Version 11.6(1)_ES9aStatusaffectedConstraints-
- Version 12.0(1)StatusaffectedConstraints-
- Version 12.0(1)_ES1StatusaffectedConstraints-
- Version 12.0(1)_ES2StatusaffectedConstraints-
- Version 12.0(1)_ES3StatusaffectedConstraints-
- Version 12.0(1)_ES4StatusaffectedConstraints-
- Version 12.0(1)_ES5StatusaffectedConstraints-
- Version 12.0(1)_ES5aStatusaffectedConstraints-
- Version 12.0(1)_ES6StatusaffectedConstraints-
- Version 12.0(1)_ES6_ET1StatusaffectedConstraints-
- Version 12.0(1)_ES6_ET2StatusaffectedConstraints-
- Version 12.0(1)_ES6_ET3StatusaffectedConstraints-
- Version 12.0(1)_ES7StatusaffectedConstraints-
- Version 12.0(1)_ES7_ET1StatusaffectedConstraints-
- Version 12.5(1)StatusaffectedConstraints-
- Version 12.5(1)_ES1StatusaffectedConstraints-
- Version 12.5(1)_ES10StatusaffectedConstraints-
- Version 12.5(1)_ES2StatusaffectedConstraints-
- Version 12.5(1)_ES3StatusaffectedConstraints-
- Version 12.5(1)_ES3_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES3_ET2StatusaffectedConstraints-
- Version 12.5(1)_ES3_ET3StatusaffectedConstraints-
- Version 12.5(1)_ES4StatusaffectedConstraints-
- Version 12.5(1)_ES4_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES4_ET2StatusaffectedConstraints-
- Version 12.5(1)_ES5StatusaffectedConstraints-
- Version 12.5(1)_ES5_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES5_ET2StatusaffectedConstraints-
- Version 12.5(1)_ES6StatusaffectedConstraints-
- Version 12.5(1)_ES6_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES7StatusaffectedConstraints-
- Version 12.5(1)_ES7_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES8StatusaffectedConstraints-
- Version 12.5(1)_ES8_ET1StatusaffectedConstraints-
- Version 12.5(1)_ES9StatusaffectedConstraints-
- Version 12.5(1)_ET1StatusaffectedConstraints-
- Version 12.6(1)StatusaffectedConstraints-
- Version 12.6(1)_ES1StatusaffectedConstraints-
- Version 12.6(1)_ES10StatusaffectedConstraints-
- Version 12.6(1)_ES10_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES11StatusaffectedConstraints-
- Version 12.6(1)_ES11_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES11_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES12StatusaffectedConstraints-
- Version 12.6(1)_ES12_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES1_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES1_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES2StatusaffectedConstraints-
- Version 12.6(1)_ES2_ET5StatusaffectedConstraints-
- Version 12.6(1)_ES3StatusaffectedConstraints-
- Version 12.6(1)_ES3_ET3StatusaffectedConstraints-
- Version 12.6(1)_ES4StatusaffectedConstraints-
- Version 12.6(1)_ES4_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES4_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES5StatusaffectedConstraints-
- Version 12.6(1)_ES5_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES5_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES5_ET3StatusaffectedConstraints-
- Version 12.6(1)_ES6StatusaffectedConstraints-
- Version 12.6(1)_ES6_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES6_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES6_ET3StatusaffectedConstraints-
- Version 12.6(1)_ES7StatusaffectedConstraints-
- Version 12.6(1)_ES7_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES8StatusaffectedConstraints-
- Version 12.6(1)_ES8_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES8_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES9StatusaffectedConstraints-
- Version 12.6(1)_ES9_ET1StatusaffectedConstraints-
- Version 12.6(1)_ES9_ET2StatusaffectedConstraints-
- Version 12.6(1)_ES9_ET3StatusaffectedConstraints-
- Version 12.6(1)_ET1StatusaffectedConstraints-
- Version 12.6(1)_ET2StatusaffectedConstraints-
- Version 12.6(1)_ET3StatusaffectedConstraints-
- Version 12.6_ES2_ET1StatusaffectedConstraints-
- Version 12.6_ES2_ET2StatusaffectedConstraints-
- Version 12.6_ES2_ET3StatusaffectedConstraints-
- Version 12.6_ES2_ET4StatusaffectedConstraints-
- Version 12.6_ES3_ET1StatusaffectedConstraints-
- Version 12.6_ES3_ET2StatusaffectedConstraints-
- Version 15.0(1)StatusaffectedConstraints-
- Version 15.0(1)ES202508StatusaffectedConstraints-
- Version 15.0(1)ES202511StatusaffectedConstraints-
- Version 15.0(1)ES202511_ET1StatusaffectedConstraints-
- Version 15.0(1)_ET1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Enterprise Chat and Email | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (1)
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisco
Published May 6, 2026
Updated May 6, 2026
Reserved Oct 8, 2025
Link CVE-2026-20172
CISA Vulnrichment
Updated May 6, 2026