A vulnerability has been found in Eleveo Quality Management 9.7.0. (CVE-2026-85406)

CVE-2026-85406 is a cross-site scripting vulnerability affecting Eleveo Quality Management 9.7.0 in the Conversation Review component. The vulnerability allows remote attackers with low privileges to inject malicious scripts, potentially impacting the integrity of user interactions. The vendor was notified but has not provided a response or fix. No affected versions beyond 9.7.0 are specified. No official patch or remediation is currently documented.

The vulnerability enables remote attackers with limited privileges to perform cross-site scripting attacks, which could lead to limited integrity impacts such as script injection in the affected component. Confidentiality and availability impacts are not indicated. There is no evidence of active exploitation in the wild.

No official patch or remediation is currently available, and the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Until a fix is provided, consider restricting access to the Conversation Review component to trusted users only and applying web application firewall (WAF) rules to detect and block XSS payloads if possible.