CVE-2026-85407: Denial of Service in Eleveo Quality Management

This vulnerability affects Eleveo Quality Management 9.7.0 in the Conversation Handler component. Specifically, the processing of the 'labels' argument in the API endpoint /enc-fwk-data/api/v3/conversations/<ID>/events is flawed, allowing an attacker to cause a denial of service remotely. The vulnerability requires no user interaction and low privileges, with no scope or confidentiality/integrity impact, but availability is impacted. The CVSS 4.0 base score is 5.3 (medium). The vendor was contacted but did not respond, and no patch or official remediation has been published. Public exploit code is available, though no active exploitation is confirmed.

Successful exploitation results in denial of service, causing the affected component to become unavailable. There is no indication of confidentiality or integrity impact. The attack can be performed remotely with low privileges and no user interaction, potentially disrupting service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should monitor for updates from Eleveo. Until a patch is released, consider restricting access to the affected API endpoint and implementing network-level protections to limit exposure.