CVE-2026-85405: Cross Site Scripting in Eleveo Call Recording Software

CVE-2026-85405 is a cross-site scripting vulnerability affecting Eleveo Call Recording Software 9.7.0. The issue exists in the /callrec/roleAddAction.do endpoint where manipulation of the name or username argument can lead to script injection. The vulnerability can be exploited remotely without requiring elevated privileges, but user interaction is needed. The CVSS 4.0 base score is 5.1, indicating medium severity. The vendor has not provided a fix or advisory, and no patch information is available. An exploit has been published, increasing the risk of potential attacks.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The vulnerability requires user interaction and does not require elevated privileges, limiting its impact to the affected user's session context. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewalls or input validation controls as temporary mitigations. Monitor for updates from Eleveo regarding patches or official workarounds.