This vulnerability arises from insufficient validation of file contents in the Lite Agent feature of Cisco Enterprise Chat and Email. An authenticated remote attacker with valid user credentials and Agent role can upload files containing malicious scripts or HTML. When other users access these files, the malicious content can execute in their browsers, potentially enabling browser-based attacks. The issue affects numerous versions of Cisco ECE as listed. No vendor advisory or patch information is currently provided.

An attacker who successfully exploits this vulnerability can cause execution of malicious scripts in the browsers of other users, potentially leading to browser-based attacks such as cross-site scripting (XSS). The attacker must have valid credentials with at least Agent role access, limiting the attack surface to authenticated users. There is no indication of impact on confidentiality or availability, only limited to integrity via script execution in user browsers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict Agent role access to trusted users only and monitor file upload activities closely. Consider implementing additional file content validation or filtering at the application or network level if possible.