CVE-2026-20172Network attack vector

Browser script execution via unvalidated file upload

Published May 6, 2026 · Updated May 6, 2026

Stored cross-site scripting in Cisco Enterprise Chat and Email allows remote authenticated users to execute scripts in another user's browser. The Lite Agent upload handler inadequately validates file contents, stores attacker-supplied scripts or HTML, and serves the uploaded file to other users. Exploitation requires Agent-or-higher credentials and an enabled Lite Agent; script execution is confined to the accessing user's browser.

CVSS severity4.3
Medium
EPSS probability0.13%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Stored cross-site scripting in Cisco Enterprise Chat and Email allows remote authenticated users to execute scripts in another user's browser. The Lite Agent upload handler inadequately validates file contents, stores attacker-supplied scripts or HTML, and serves the uploaded file to other users. Exploitation requires Agent-or-higher credentials and an enabled Lite Agent; script execution is confined to the accessing user's browser.

The record

CVE
CVE-2026-20172
Published
May 6, 2026
Updated
May 6, 2026
Vendor
ClamAV
Product
Cisco Enterprise Chat and Email
Classifications
CWE-646, T1059.007
Attack vector
network
Privileges
authenticated

Timeline

How it unfolded

  1. May 6, 2026CVE publishedPublication date reported by the CVE source.
  2. May 6, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=11.5(1)
  2. Affected versionversion=11.6(1)
  3. Affected versionversion=11.6(1)_ES10
  4. Affected versionversion=11.6(1)_ES11
  5. Affected versionversion=11.6(1)_ES12
  6. Affected versionversion=11.6(1)_ES12_ET1
  7. Affected versionversion=11.6(1)_ES2
  8. Affected versionversion=11.6(1)_ES3
  9. Affected versionversion=11.6(1)_ES4
  10. Affected versionversion=11.6(1)_ES5
  11. Affected versionversion=11.6(1)_ES6
  12. Affected versionversion=11.6(1)_ES7
  13. Affected versionversion=11.6(1)_ES8
  14. Affected versionversion=11.6(1)_ES9
  15. Affected versionversion=11.6(1)_ES9a
  16. Affected versionversion=12.0(1)
  17. Affected versionversion=12.0(1)_ES1
  18. Affected versionversion=12.0(1)_ES2
  19. Affected versionversion=12.0(1)_ES3
  20. Affected versionversion=12.0(1)_ES4
  21. Affected versionversion=12.0(1)_ES5
  22. Affected versionversion=12.0(1)_ES5a
  23. Affected versionversion=12.0(1)_ES6
  24. Affected versionversion=12.0(1)_ES6_ET1
  25. Affected versionversion=12.0(1)_ES6_ET2
  26. Affected versionversion=12.0(1)_ES6_ET3
  27. Affected versionversion=12.0(1)_ES7
  28. Affected versionversion=12.0(1)_ES7_ET1
  29. Affected versionversion=12.5(1)
  30. Affected versionversion=12.5(1)_ES1
  31. Affected versionversion=12.5(1)_ES10
  32. Affected versionversion=12.5(1)_ES2
  33. Affected versionversion=12.5(1)_ES3
  34. Affected versionversion=12.5(1)_ES3_ET1
  35. Affected versionversion=12.5(1)_ES3_ET2
  36. Affected versionversion=12.5(1)_ES3_ET3
  37. Affected versionversion=12.5(1)_ES4
  38. Affected versionversion=12.5(1)_ES4_ET1
  39. Affected versionversion=12.5(1)_ES4_ET2
  40. Affected versionversion=12.5(1)_ES5
  41. Affected versionversion=12.5(1)_ES5_ET1
  42. Affected versionversion=12.5(1)_ES5_ET2
  43. Affected versionversion=12.5(1)_ES6
  44. Affected versionversion=12.5(1)_ES6_ET1
  45. Affected versionversion=12.5(1)_ES7
  46. Affected versionversion=12.5(1)_ES7_ET1
  47. Affected versionversion=12.5(1)_ES8
  48. Affected versionversion=12.5(1)_ES8_ET1
  49. Affected versionversion=12.5(1)_ES9
  50. Affected versionversion=12.5(1)_ET1
  51. Affected versionversion=12.6(1)
  52. Affected versionversion=12.6(1)_ES1
  53. Affected versionversion=12.6(1)_ES10
  54. Affected versionversion=12.6(1)_ES10_ET1
  55. Affected versionversion=12.6(1)_ES11
  56. Affected versionversion=12.6(1)_ES11_ET1
  57. Affected versionversion=12.6(1)_ES11_ET2
  58. Affected versionversion=12.6(1)_ES12
  59. Affected versionversion=12.6(1)_ES12_ET1
  60. Affected versionversion=12.6(1)_ES1_ET1
  61. Affected versionversion=12.6(1)_ES1_ET2
  62. Affected versionversion=12.6(1)_ES2
  63. Affected versionversion=12.6(1)_ES2_ET5
  64. Affected versionversion=12.6(1)_ES3
  65. Affected versionversion=12.6(1)_ES3_ET3
  66. Affected versionversion=12.6(1)_ES4
  67. Affected versionversion=12.6(1)_ES4_ET1
  68. Affected versionversion=12.6(1)_ES4_ET2
  69. Affected versionversion=12.6(1)_ES5
  70. Affected versionversion=12.6(1)_ES5_ET1
  71. Affected versionversion=12.6(1)_ES5_ET2
  72. Affected versionversion=12.6(1)_ES5_ET3
  73. Affected versionversion=12.6(1)_ES6
  74. Affected versionversion=12.6(1)_ES6_ET1
  75. Affected versionversion=12.6(1)_ES6_ET2
  76. Affected versionversion=12.6(1)_ES6_ET3
  77. Affected versionversion=12.6(1)_ES7
  78. Affected versionversion=12.6(1)_ES7_ET1
  79. Affected versionversion=12.6(1)_ES8
  80. Affected versionversion=12.6(1)_ES8_ET1
  81. Affected versionversion=12.6(1)_ES8_ET2
  82. Affected versionversion=12.6(1)_ES9
  83. Affected versionversion=12.6(1)_ES9_ET1
  84. Affected versionversion=12.6(1)_ES9_ET2
  85. Affected versionversion=12.6(1)_ES9_ET3
  86. Affected versionversion=12.6(1)_ET1
  87. Affected versionversion=12.6(1)_ET2
  88. Affected versionversion=12.6(1)_ET3
  89. Affected versionversion=12.6_ES2_ET1
  90. Affected versionversion=12.6_ES2_ET2
  91. Affected versionversion=12.6_ES2_ET3
  92. Affected versionversion=12.6_ES2_ET4
  93. Affected versionversion=12.6_ES3_ET1
  94. Affected versionversion=12.6_ES3_ET2
  95. Affected versionversion=15.0(1)
  96. Affected versionversion=15.0(1)ES202508
  97. Affected versionversion=15.0(1)ES202511
  98. Affected versionversion=15.0(1)ES202511_ET1
  99. Affected versionversion=15.0(1)_ET1

What conditions does exploitation require?

Attack vectornetwork
Required privilegesauthenticated

What is affected?

ClamAV · Cisco Enterprise Chat and Emailversion=11.5(1); version=11.6(1); version=11.6(1)_ES10; version=11.6(1)_ES11; version=11.6(1)_ES12; version=11.6(1)_ES12_ET1; version=11.6(1)_ES2; version=11.6(1)_ES3; version=11.6(1)_ES4; version=11.6(1)_ES5; version=11.6(1)_ES6; version=11.6(1)_ES7; version=11.6(1)_ES8; version=11.6(1)_ES9; version=11.6(1)_ES9a; version=12.0(1); version=12.0(1)_ES1; version=12.0(1)_ES2; version=12.0(1)_ES3; version=12.0(1)_ES4; version=12.0(1)_ES5; version=12.0(1)_ES5a; version=12.0(1)_ES6; version=12.0(1)_ES6_ET1; version=12.0(1)_ES6_ET2; version=12.0(1)_ES6_ET3; version=12.0(1)_ES7; version=12.0(1)_ES7_ET1; version=12.5(1); version=12.5(1)_ES1; version=12.5(1)_ES10; version=12.5(1)_ES2; version=12.5(1)_ES3; version=12.5(1)_ES3_ET1; version=12.5(1)_ES3_ET2; version=12.5(1)_ES3_ET3; version=12.5(1)_ES4; version=12.5(1)_ES4_ET1; version=12.5(1)_ES4_ET2; version=12.5(1)_ES5; version=12.5(1)_ES5_ET1; version=12.5(1)_ES5_ET2; version=12.5(1)_ES6; version=12.5(1)_ES6_ET1; version=12.5(1)_ES7; version=12.5(1)_ES7_ET1; version=12.5(1)_ES8; version=12.5(1)_ES8_ET1; version=12.5(1)_ES9; version=12.5(1)_ET1; version=12.6(1); version=12.6(1)_ES1; version=12.6(1)_ES10; version=12.6(1)_ES10_ET1; version=12.6(1)_ES11; version=12.6(1)_ES11_ET1; version=12.6(1)_ES11_ET2; version=12.6(1)_ES12; version=12.6(1)_ES12_ET1; version=12.6(1)_ES1_ET1; version=12.6(1)_ES1_ET2; version=12.6(1)_ES2; version=12.6(1)_ES2_ET5; version=12.6(1)_ES3; version=12.6(1)_ES3_ET3; version=12.6(1)_ES4; version=12.6(1)_ES4_ET1; version=12.6(1)_ES4_ET2; version=12.6(1)_ES5; version=12.6(1)_ES5_ET1; version=12.6(1)_ES5_ET2; version=12.6(1)_ES5_ET3; version=12.6(1)_ES6; version=12.6(1)_ES6_ET1; version=12.6(1)_ES6_ET2; version=12.6(1)_ES6_ET3; version=12.6(1)_ES7; version=12.6(1)_ES7_ET1; version=12.6(1)_ES8; version=12.6(1)_ES8_ET1; version=12.6(1)_ES8_ET2; version=12.6(1)_ES9; version=12.6(1)_ES9_ET1; version=12.6(1)_ES9_ET2; version=12.6(1)_ES9_ET3; version=12.6(1)_ET1; version=12.6(1)_ET2; version=12.6(1)_ET3; version=12.6_ES2_ET1; version=12.6_ES2_ET2; version=12.6_ES2_ET3; version=12.6_ES2_ET4; version=12.6_ES3_ET1; version=12.6_ES3_ET2; version=15.0(1); version=15.0(1)ES202508; version=15.0(1)ES202511; version=15.0(1)ES202511_ET1; version=15.0(1)_ET1

Published CVSS scores

4.3Cisco Systems, Inc.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:X

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-646Reliance on File Name or Extension of Externally-Supplied File
T1059.007JavaScript/JScript

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo