Vulnerability · Published Sep 4, 2026 · Assigned by VulDB
CVE-2026-85407Eleveo Quality Management Conversation events denial of service
Medium 4.3
In plain English
A medium-severity security flaw in Quality Management from Eleveo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. The manipulation of the argument labels results in denial of service. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eleveo | Quality Management | 9.7.0 |
Weakness: CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-398557 | Eleveo Quality Management Conversation events denial of service vdb-entry, technical-description
- VDB-398557 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-85407 | CVE Analysis and Report third-party-advisory
- Submit #894902 | Eleveo Quality Management 9.7.0 Denial of Service third-party-advisory
- https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-85407 exploit