THREAT INTELLIGENCE REPORT: CVE-2026-85405

Executive Summary

CVE-2026-85405 is a reflected/persistent cross-site scripting (XSS) vulnerability in Eleveo Call Recording Software version 9.7.0, specifically affecting the /callrec/roleAddAction.do endpoint. An authenticated attacker with low-privilege access can manipulate the name or username parameters to inject malicious scripts that execute in the context of another user's browser session. The vendor was contacted but failed to respond, leaving the product unpatchable at present. Given the sensitive nature of call recording data (which may include PCI-DSS-regulated payment card information, healthcare data under HIPAA, and customer PII), a successful XSS exploitation chain could lead to session hijacking, administrative account compromise, and unauthorized access to recorded communications. The vulnerability is remotely exploitable, requires low attack complexity, but demands user interaction and low privileges, resulting in a modest CVSS base score of 3.5.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2026-85405 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) — commonly referred to as Cross-Site Scripting. The flaw resides in the roleAddAction.do endpoint within the Eleveo Call Recording application's role management functionality.

Affected component: /callrec/roleAddAction.do — a Java Struts-style action endpoint (indicated by the .do extension) responsible for adding or modifying user roles within the call recording system.

Vulnerable parameters: name and username — both arguments are accepted via the endpoint and are subsequently rendered into an HTML response without adequate sanitization or output encoding.

Attack mechanism: The application fails to neutralize user-supplied input before reflecting it back to the browser. An attacker submits a crafted payload through the name or username parameters containing HTML/JavaScript. When the response is rendered by a victim's browser, the injected script executes with the victim's application session context, inheriting all privileges and data access that the victim possesses.

Attack surface: The endpoint is accessible via the application's HTTP interface. Because the .do extension suggests a Struts-based MVC framework, the attack surface is the web application layer — the attacker interacts with the endpoint via HTTP POST or GET requests.

Authentication requirement: The CVSS vector (PR:L) confirms that the attacker must possess valid low-privilege credentials (such as a basic call agent or supervisor account) to reach the vulnerable functionality. This is consistent with role-management features being restricted to authenticated users.

User interaction requirement: The UI:R component of the attack vector implies that successful exploitation depends on a victim (potentially an administrator) clicking on or otherwise interacting with a poisoned link or crafted content that triggers the XSS payload execution.

No technical detail on the exact rendering context (e.g., whether the payload is reflected directly into an attribute, within a script block, or via DOM manipulation) is available from the NVD description. Insufficient technical detail is available to determine whether the injection point uses single/double quotes, angle brackets, or alternative encoding-based bypasses.

Application Context

Eleveo Call Recording Software is an enterprise-grade solution used to capture, store, and analyze customer interactions — typically in contact centers, financial institutions, emergency dispatch centers, and healthcare organizations. Call recordings routinely contain highly sensitive information: credit card numbers spoken during transactions, protected health information (PHI), authentication credentials provided by callers, and personal identifiers. The platform provides role-based access control to govern who can listen to, search, or export recorded interactions.

This context significantly elevates the practical risk of a low-CVSS XSS: the data accessible through a compromised session is exceptionally sensitive.

Exploitation Scenarios

Note: No public PoC or exploit code is available (PoC/Exploit: None per CVE data). The attack chain described below is inferred from the vulnerability class and the NVD description. Specific implementation details not present in the description are not fabricated — the chain is described at the class level.

Step 1: Reconnaissance and Target Identification

An attacker with valid low-privilege credentials (e.g., a call agent account) first maps the application to confirm that the /callrec/roleAddAction.do endpoint is reachable and that the name/username parameters are actively processed. This can be done by submitting benign requests and inspecting the response for echoed input. Internet-wide reconnaissance (e.g., via Shodan) could identify exposed Eleveo instances, but such discovery would only identify potential victims — exploitation still requires valid credentials.

Step 2: Triggering the Flaw

The attacker crafts a malicious URL containing an XSS payload within the name or username parameter. Because the endpoint is a role-add action, the attacker may also use a legitimate role-creation request to persist the payload — if the payload is stored (e.g., in a role name displayed to administrators) rather than merely reflected, this becomes a stored XSS vector with broader reach.

https://victim.example.com/callrec/roleAddAction.do?name=<script>/* payload */</script>

Step 3: Payload Delivery and Execution

The attacker must lure a victim — most likely an administrative user (whose role grants access to the call recording archive and user management features) — into clicking the crafted link. This can be achieved via:

• Phishing email with a disguised hyperlink.
• In-application messaging (if the platform supports user-to-user communication).
• Social engineering via telephone or third-party chat.

The victim's session cookie is not transmitted to the attacker directly (no credential theft at this stage). Instead, the injected JavaScript executes in the victim's browser context against the Eleveo application origin. The script operates within the same-origin policy boundary, meaning it can:

• Read and exfiltrate the victim's CSRF tokens.
• Submit requests on the victim's behalf (e.g., escalate attacker's role to administrator).
• Read DOM content that may reflect sensitive application data.

Step 4: Post-Exploitation Impact

Following successful script execution in an administrative context, the attacker's JavaScript payload can:

• Issue a request to elevate the attacker's account to full administrator privileges.
• Modify the role of other low-privilege accounts.
• Access the call recording search/index functionality and exfiltrate references to stored recordings (the XSS payload can trigger download URLs that proxy recordings to the attacker's infrastructure).
• Harvest administrative session tokens for persistent access.

The resulting impact is confidentiality breach (exfiltration of call recordings, customer data) and integrity breach (unauthorized privilege changes), consistent with the CVSS subscores of C:N/I:L/A:N at the base level, but with potentially higher real-world impact when chained with privilege escalation and given the sensitivity of recorded data.

Impact Assessment

Business Impact

Eleveo Call Recording Software is deployed in environments with strict compliance obligations:

• PCI DSS: Recorded calls may contain full PAN (Primary Account Numbers). Access must be strictly controlled.
• HIPAA/HITECH: Healthcare contact centers record PHI.
• GDPR/CCPA: Recorded consent and personal data.
• Financial regulations (FINRA, MiFID II): Broker-dealer communications must be retained and protected.

A successful XSS exploitation leading to administrative compromise could expose this regulated data, triggering legally mandated breach disclosure obligations, fines, and reputational damage.

CVSS Breakdown Relevance

• AV:N (Network): Exploitable from anywhere the application is reachable.
• AC:L (Low): No advanced preparation or race conditions needed.
• PR:L (Low): Requires a valid low-privilege account — realistically obtainable via social engineering of an agent or via other credential-compromise campaigns.
• UI:R (Required): Victim interaction needed; somewhat depresses practical exploitability.
• S:U (Unchanged): The compromised component is isolated; adjacent components not directly affected.
• C:N (None) / I:L (Low) / A:N (None): Direct CIA impact rated low, but chained attacks (privilege escalation to administrator) magnify the real-world consequences.

Affected Systems

• Eleveo Call Recording 9.7.0 — confirmed. Other versions not officially identified as affected, but absence of evidence is not evidence of absence. The vendor has not issued any advisory or version-specific patch guidance.

Blast Radius

The immediate blast radius is the Eleveo web application and its underlying call recording database. However, because call recording platforms are frequently integrated with CRM systems (Salesforce, Dynamics), ticketing systems, and directory services (LDAP/Active Directory), a pivot from the compromised session could extend the radius to connected enterprise systems.

Detection Guidance

Sigma Rule

title: Eleveo CallRec - XSS Attempt via roleAddAction.do Parameters
id: 2f8e7c4a-9b3d-4e1f-8a2c-5d6b7e8f9a0b
status: experimental
description: Detects XSS payload delivery attempts against the Eleveo Call Recording roleAddAction.do endpoint via name/username parameters.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85405
author: Valters IT Security Team
date: 2026/05/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Eleveo application host'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - 'roleAddAction.do'
    keywords:
        - '*name*<script*'
        - '*username*<script*'
        - '*name*javascript:*'
        - '*username*javascript:*'
        - '*name*onerror=*'
        - '*username*onerror=*'
        - '*name*onload=*'
        - '*username*onload=*'
        - '*name*%3Cscript*'
        - '*username*%3Cscript*'
        - '*name*%3Csvg*'
        - '*username*%3Csvg*'
        - '*name*%3Cimg*'
        - '*username*%3Cimg*'
        - '*name*<svg*'
        - '*username*<svg*'
        - '*name*<img*'
        - '*username*<img*'
        - '*name*<iframe*'
        - '*username*<iframe*'
        - '*name*<body*'
        - '*username*<body*'
    condition: selection and keywords
falsepositives:
    - Legitimate URL-encoded special characters in role names (very rare)
level: high

YARA Rule

rule CVE_2026_85405_Eleveo_XSS_Traffic
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects HTTP payloads associated with CVE-2026-85405 XSS in Eleveo roleAddAction.do"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85405"
        severity = "medium"
        cve = "CVE-2026-85405"

    strings:
        $endpoint = "roleAddAction.do" ascii wide nocase
        $param_name = "name=" ascii wide nocase
        $param_username = "username=" ascii wide nocase
        
        // XSS payload markers
        $tag_script = "<script" ascii wide nocase
        $tag_svg = "<svg" ascii wide nocase
        $tag_img = "<img" ascii wide nocase
        $tag_iframe = "<iframe" ascii wide nocase
        $tag_body = "<body" ascii wide nocase
        $tag_input = "<input" ascii wide nocase
        $tag_form = "<form" ascii wide nocase
        $event_onerror = "onerror=" ascii wide nocase
        $event_onload = "onload=" ascii wide nocase
        $event_onclick = "onclick=" ascii wide nocase
        $event_onfocus = "onfocus=" ascii wide nocase
        $keyword_alert = "alert(" ascii wide nocase
        $keyword_prompt = "prompt(" ascii wide nocase
        $keyword_confirm = "confirm(" ascii wide nocase
        $keyword_fetch = "fetch(" ascii wide nocase
        $keyword_xmlhttp = "XMLHttpRequest" ascii wide nocase
        $keyword_eval = "eval(" ascii wide nocase
        $keyword_doc_cookie = "document.cookie" ascii wide nocase
        $keyword_encode = "encodeURIComponent" ascii wide nocase
        $enc_lt = "%3C" ascii wide nocase
        $enc_gt = "%3E" ascii wide nocase
        $enc_scr = "%73cript" ascii wide nocase
        $enc_svg = "%73vg" ascii wide nocase
        $enc_img = "%69mg" ascii wide nocase

    condition:
        uint16(0) == 0x4854 and // "HT" - HTTP or HTTPS traffic
        $endpoint and
        ($param_name or $param_username) and
        2 of ($tag_script, $tag_svg, $tag_img, $tag_iframe, $tag_body, $tag_input, $tag_form, $enc_lt) and
        (1 of ($event_onerror, $event_onload, $event_onclick, $event_onfocus, $keyword_alert, $keyword_prompt, $keyword_confirm, $keyword_fetch, $keyword_xmlhttp, $keyword_eval, $keyword_doc_cookie, $keyword_encode))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-85405 - Eleveo CallRec roleAddAction.do XSS Attempt";
    flow:to_server,established;
    content:"roleAddAction.do"; http_uri; nocase;
    content:"name="; http_uri; nocase;
    pcre:"/(?:<|<%3c|%3C)(?:script|svg|img|iframe|body|input|form|object|embed|link|style|math|video|audio|source|track|marquee|details)/i";
    pcre:"/(?:onerror|onload|onclick|onmouseover|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup|onabort|onbeforeunload|onhashchange|onpageshow|onpopstate|onresize|onscroll|onunload|onwheel|ondrag|ondrop)\s*=/i";
    classtype:web-application-attack;
    sid:10085405;
    rev:1;
    metadata:created_at 2026_05_15, cve CVE_2026_85405, attacker_skill Low, target_product Eleveo;
)

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-85405 - Eleveo CallRec roleAddAction.do Possible XSS (username parameter)";
    flow:to_server,established;
    content:"roleAddAction.do"; http_uri; nocase;
    content:"username="; http_uri; nocase;
    pcre:"/(?:<|<%3c|%3C)(?:script|svg|img|iframe|body|input|form|object|embed|link|style|math|video|audio|source|track|marquee|details)/i";
    pcre:"/(?:alert|prompt|confirm|print|document\.cookie|fetch|XMLHttpRequest|eval|atob|String\.fromCharCode)\s*\(/i";
    sid:10085406;
    rev:1;
    classtype:web-application-attack;
    metadata:created_at 2026_05_15, cve CVE_2026_85405;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and network.protocol == "http"
    and url.path contains "roleAddAction.do"
    and (
      url.query contains "name=" or url.query contains "username="
    )
    and (
      url.query contains "<script" or url.query contains "<svg" or 
      url.query contains "<img" or url.query contains "<iframe" or
      url.query contains "onerror=" or url.query contains "onload=" or
      url.query contains "javascript:" or url.query contains "%3Cscript" or
      url.query contains "%3Csvg" or url.query contains "%3Cimg" or
      url.query contains "alert(" or url.query contains "prompt(" or
      url.query contains "confirm(" or url.query contains "document.cookie" or
      url.query contains "fetch(" or url.query contains "XMLHttpRequest"
    )
  ]
  [ authentication where event.outcome == "success"
    and user.name != null
  ]

Alternative EQL rule for HTTP log pipelines (filebeat/auditbeat):

any where event.category == "web" and http.request.method == "GET" 
  and url.path like "*roleAddAction.do*"
  and (url.query like "*name=*" or url.query like "*username=*")
  and (url.query like "*<script*" or url.query like "*<svg*" or 
       url.query like "*<img*" or url.query like "*<iframe*" or
       url.query like "*onerror=*" or url.query like "*onload=*" or
       url.query like "*onclick=*" or url.query like "*javascript:*" or
       url.query like "*%3Cscript*" or url.query like "*%3Csvg*" or
       url.query like "*%3Cimg*" or url.query like "*%3Ciframe*" or
       url.query like "*alert(*" or url.query like "*prompt(*" or
       url.query like "*confirm(*" or url.query like "*document.cookie*" or
       url.query like "*fetch(*" or url.query like "*XMLHttpRequest*")

Splunk SPL Query

index=web OR index=proxy OR sourcetype=access_combined
| where like(uri_path, "%roleAddAction.do%")
| where (like(uri_query, "%name=%") OR like(uri_query, "%username=%"))
| where (like(uri_query, "%<script%") OR like(uri_query, "%<svg%") OR 
         like(uri_query, "%<img%") OR like(uri_query, "%<iframe%") OR 
         like(uri_query, "%<body%") OR like(uri_query, "%<input%") OR 
         like(uri_query, "%<form%") OR like(uri_query, "%javascript:%") OR 
         like(uri_query, "%onerror=%") OR like(uri_query, "%onload=%") OR 
         like(uri_query, "%onclick=%") OR like(uri_query, "%onmouseover=%") OR 
         like(uri_query, "%alert(%") OR like(uri_query, "%prompt(%") OR 
         like(uri_query, "%confirm(%") OR like(uri_query, "%document.cookie%") OR 
         like(uri_query, "%fetch(%") OR like(uri_query, "%XMLHttpRequest%") OR 
         like(uri_query, "%eval(%") OR like(uri_query, "%atob(%") OR 
         like(uri_query, "%3Cscript%") OR like(uri_query, "%3Csvg%") OR 
         like(uri_query, "%3Cimg%") OR like(uri_query, "%3Ciframe%") OR 
         like(uri_query, "%3Cbody%") OR like(uri_query, "%3Cinput%") OR 
         like(uri_query, "%3Cform%") OR like(uri_query, "%u003Cscript%") OR 
         like(uri_query, "%25253Cscript%"))
| table _time, src_ip, dest_ip, dest_host, uri, uri_path, uri_query, http_method, http_user_agent, status, user
| sort - _time
| rename src_ip AS "Source IP", dest_ip AS "Destination IP", dest_host AS "Server", uri_query AS "Request Query", user AS "Authenticated User"

Alternate query focused on POST body data:

index=web OR index=proxy
(uri_path=*/callrec/roleAddAction.do) OR (form_data=*roleAddAction.do*)
| where (like(form_data, "%name=%") OR like(form_data, "%username=%"))
| where (like(form_data, "%<script%") OR like(form_data, "%onerror=%") OR like(form_data, "%javascript:%"))
| table _time, src_ip, dest_ip, uri, form_data, http_method, user

Wazuh OSSEC Rule

<group name="web_application_attack,">
    <rule id="100854" level="10">
        <if_sid>31100</if_sid>
        <field name="url">\.roleAddAction\.do</field>
        <regex>(\?|&)(name|username)=.*(&lt;|%3C|%253C|%u003C|\x3c)(script|svg|img|iframe|body|input|form|object|embed|link|style|math|video|audio)</regex>
        <description>CVE-2026-85405: Eleveo Call Recording roleAddAction.do XSS payload detected in request (name/username parameter). Possible cross-site scripting attempt.</description>
        <group>web_application_attack,xss,cve_2026_85405,eleveo,attack</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="100855" level="10">
        <if_sid>31100</if_sid>
        <field name="url">\.roleAddAction\.do</field>
        <regex>(\?|&)(name|username)=.*(onerror|onload|onclick|onmouseover|onfocus|onblur|onchange|onsubmit|onreset|onselect|onkeydown|onkeypress|onkeyup)\s*[=]</regex>
        <description>CVE-2026-85405: Eleveo Call Recording roleAddAction.do XSS via event-handler attribute injection detected.</description>
        <group>web_application_attack,xss,cve_2026_85405,eleveo,attack</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="100856" level="8">
        <if_sid>31100</if_sid>
        <field name="url">\.roleAddAction\.do</field>
        <regex>(\?|&)(name|username)=.*(alert|prompt|confirm|print|eval|atob)[\s]*\(</regex>
        <description>CVE-2026-85405: Eleveo Call Recording roleAddAction.do request with JavaScript execution functions detected in parameters.</description>
        <group>web_application_attack,xss,cve_2026_85405,eleveo,attack</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="100857" level="10">
        <if_sid>31100</if_sid>
        <field name="url">\.roleAddAction\.do</field>
        <regex>(\?|&)(name|username)=.*(document\.cookie|XMLHttpRequest|fetch\s*\(|XMLHttpRequest|\.sessionStorage|\.localStorage)</regex>
        <description>CVE-2026-85405: Eleveo Call Recording roleAddAction.do XSS payload attempting session/token exfiltration detected.</description>
        <group>web_application_attack,xss,cve_2026_85405,session_hijacking,eleveo,attack</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>

    <rule id="100858" level="7">
        <if_sid>31100</if_sid>
        <field name="url">\.roleAddAction\.do</field>
        <regex>(\?|&)(name|username)=.*(&#x|&#[0-9]+;|&colon;|&sol;|&lpar;|&rpar;|&comma;)</regex>
        <description>CVE-2026-85405: Eleveo Call Recording roleAddAction.do query contains HTML-entity-encoded suspicious characters. Possible XSS obfuscation attempt.</description>
        <group>web_application_attack,xss,cve_2026_85405,eleveo,attack</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status

PATCH CONFIDENCE: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor (Eleveo) was contacted early during the disclosure process but did not respond in any way. No fixed version has been announced, and no workaround has been provided by the vendor.

1) Immediate Mitigations (Implement Now)

2) Patch/Upgrade Steps

1. Monitor for vendor advisories — check Eleveo's official website and any customer portal for security announcements. The vendor has been unresponsive; escalate via regional sales contacts if you have a support contract.

2. Watch for community disclosures — monitor NVD, vendor security mailing lists, and researcher blogs for supplementary guidance or unofficial patches.

3. Test in staging once a patch is released: verify the fix covers both name and username parameters and the .do endpoint across all affected input modes (GET, POST, multipart).

4. Plan for upgrade to a version that addresses CWE-79 if Eleveo releases one. If no patch arrives within 90 days, consider:

   • Filing a formal support ticket and escalating through management channels.
   • Engaging a third-party security firm to implement a code-level audit that produces an internal, unofficial patch.
   • Evaluating migration to a different call recording platform.

3) Long-Term Hardening

• Input validation: Enforce strict whitelist validation on name/username fields — only allow alphanumeric, space, @, ., -, _ characters. Reject/sanitize all others.
• Output encoding: Ensure the application contextually encodes all user-controlled data before rendering in HTML responses (e.g., use OWASP ESAPI or equivalent encoding libraries).
• Content Security Policy (CSP): Implement a strict CSP header (default-src 'none'; script-src 'self') to block inline script execution in case XSS bypasses server-side filtering.
• Web Application Firewall: Deploy a WAF with OWASP CRS rulesets in front of the application.
• Security reviews: Request an application security assessment from Eleveo; if unresponsive, commission an independent penetration test focused on Struts-based endpoints.
• Monitoring: Maintain logging and alerting on all role-management actions and privilege escalations within the application.
• Least privilege: Ensure that low-privilege accounts (e.g., call agents) do not have access to the role-management module unless strictly required.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-85405
2. Eleveo Official Site (vendor): https://www.eleveo.com — monitor for security advisories; vendor non-responsive as of this report.
3. MITRE CWE-79: https://cwe.mitre.org/data/definitions/79.html
4. CVSS Calculator v3.1: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-85405 is NOT currently listed (status: NO in KEV).

Exploit Activity & Threat Actor Campaigns

• No known threat actor campaigns have been publicly attributed to this CVE at the time of writing.
• Published exploit referenced: NVD Description states "The exploit has been published and may be used," but no public repository or exploit-database entry has been located in tracked sources. PoC/Exploit status: None in our tooling. The discrepancy suggests the exploit may exist on underground forums or in limited-distribution researcher materials.
• CISA KEV: Not listed — no confirmed in-the-wild exploitation by CISA's standards as of the report date.
• EPSS: Not yet scored by FIRST.org — a score will be published as ecosystem data accumulates.

Report generated by Valters IT Security. This document is intended for authorized security teams. Verify all technical claims against your own infrastructure.