Vulnerability · Published Oct 27, 2026 · Assigned by INCIBE
CVE-2026-117494Multiple vulnerabilities in Sisense’s Cloud BI Platform
High 8.3
In plain English
A high-severity cross-site scripting in Cloud BI Platform from Sisense. There are no confirmed reports of exploitation so far.
Severity (CVSS 4.0)8.3High
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sisense | Cloud BI Platform | 0 – before 27/10/2026 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L