CVE-2026-85407: Denial of Service in Eleveo Quality Management

This vulnerability affects Eleveo Quality Management 9.7.0 in the Conversation Handler component. Specifically, manipulation of the 'labels' argument in the API path /enc-fwk-data/api/v3/conversations/<ID>/events can cause a denial of service condition. The attack vector is remote network access with low complexity and no user interaction required. The vendor was notified but did not respond, and no official fix or patch is currently available. Public exploit code has been published, but no known exploitation in the wild has been reported.

Successful exploitation results in denial of service, potentially disrupting the availability of the affected Eleveo Quality Management service. The vulnerability does not require elevated privileges or user interaction, increasing the risk of remote attacks. However, no evidence of active exploitation in the wild has been documented.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. In the meantime, restricting network access to the affected API endpoint and implementing network-level protections may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.