CVE-2026-85408

Executive Summary

CVE-2026-85408 is an unauthenticated-adjacent (low-privilege) remote manipulation vulnerability affecting Eleveo Quality Management 9.7.0, specifically within the Conversation Handler component. The vulnerability allows a remote attacker with low-privilege access to manipulate dynamically-determined object attributes via the createdBy parameter in the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint, leading to a low-integrity impact on the application's data objects. The vendor has been contacted but has not responded, and no patch is currently available, leaving affected deployments exposed to integrity tampering attacks on conversation event records.

Technical Analysis

The NVD description identifies CVE-2026-85408 as a vulnerability classified under CWE-913 (Improper Control of Dynamically-Managed Code Resources) . This weakness class arises when an application fails to properly control, validate, or sanitize dynamically-determined object attributes or resources, allowing an attacker to influence which attributes, properties, or code paths are executed or modified at runtime.

Affected Component: The flaw resides in the Conversation Handler of Eleveo Quality Management 9.7.0. The specific functional endpoint is described as /enc-fwk-data/api/v3/conversations/<ID>/events, where <ID> represents a conversation identifier. This endpoint appears to manage events associated with recorded or monitored conversations within a quality management platform — a context typically used for contact-center call recording, agent evaluation, and compliance auditing.

Vulnerable Parameter: The attack vector involves manipulation of the createdBy argument. Per the NVD description, manipulating this parameter causes "dynamically-determined object attributes" — indicating that the application likely uses attacker-controlled input to resolve, at runtime, which object properties or metadata fields (e.g., which user/agent created an event record) are accessed, modified, or created. This aligns with CWE-913's definition where dynamic code or resource selection is performed without adequate allow-listing or validation.

Attack Surface: The endpoint is an API route that is remotely accessible. While the CVSS vector requires low-privilege authentication (PR:L), the attack requires no user interaction (UI:N), does not impact confidentiality (C:N), has low integrity impact (I:L), and no availability impact (A:N). The attack complexity is low (AC:L), meaning no special conditions beyond authentication are needed to exploit it.

Technical Detail Caveat: The NVD description provides limited implementation-level detail. Specifically absent are: the exact HTTP methods accepted by the endpoint (GET/POST/PUT/PATCH), the underlying programming language or framework, the database/object-mapping layer used, and whether the dynamic attribute resolution leads to mass-assignment, prototype pollution, or object injection. Without vendor disclosure or a detailed public analysis, the precise exploitation mechanics — including what final impact the createdBy tampering produces (e.g., forging audit records, altering event attribution, or bypassing access-control checks on event objects) — cannot be conclusively determined. Per authoritative accuracy requirements, the description should be treated as indicating a broad dynamic-attribute improper-control flaw rather than a narrowly characterized injection or deserialization bug.

Exploitation Scenarios

The following attack chain is constructed at the vulnerability-class level, based strictly on information available in the NVD description. No public PoC has been documented; the attack chain below is inferred from the CWE-913 classification and endpoint semantics.

Step 1 — Reconnaissance and Target Identification: An attacker with valid low-privilege credentials (e.g., an agent account or junior supervisor role) begins by mapping the Eleveo Quality Management 9.7.0 web API surface. The attacker enumerates the /enc-fwk-data/api/v3/conversations/ API namespace, attempting to discover a valid conversation <ID> (by iterating numeric identifiers or from a previous legitimate session). Shodan/Fofa queries such as product:"Eleveo" can identify internet-exposed instances (however, given the enterprise call-center nature of the product, most deployments are behind VPN or internal networks — greater likelihood of insider or low-privilege-account exploitation).

Step 2 — Triggering the Flaw: The attacker sends a crafted HTTP request to /enc-fwk-data/api/v3/conversations/<ID>/events targeting the createdBy parameter. Because the endpoint dynamically maps this parameter to an object attribute without proper allow-listing (CWE-913), the attacker submits an unexpected value — potentially a nested object, an array, or a field name referencing internal attributes outside the normal createdBy property set.

Step 3 — Payload/Execution Method: At the vulnerability-class level, CWE-913 allows the attacker to influence which object property is resolved or written. A likely exploitation pattern is tampering with the attribution of conversation event records — e.g., changing the createdBy value to impersonate another user, or injecting additional meta-attributes into the event object to corrupt audit trails or alignment between conversation recordings and quality-evaluation events. If the dynamic resolution extends to method or function invocation (as the CWE-913 label implies possible "dynamically-managed code resources"), there is a theoretical escalation to logic manipulation — however, given the low CVSS integrity score (I:L), the impact is likely confined to data/object modification rather than remote code execution.

Step 4 — Post-Exploitation Impact: Successful exploitation results in low-integrity alteration of event records associated with conversations. In a quality management platform, this translates to: forging or modifying agent evaluation timestamps/attribution, altering quality scoring records, corrupting compliance evidence for recorded interactions, or destabilizing downstream reporting that ingests these events. Because the attacker is already authenticated (low privilege), this is primarily an integrity bypass of object-level controls rather than an authentication bypass or data exfiltration vector (confidentiality impact is none).

Impact Assessment

CVSS Analysis: Base Score 4.3 (Medium)

• Attack Vector: Network (AV:N) — Remotely exploitable via the web/API interface.
• Attack Complexity: Low (AC:L) — No special conditions beyond authentication; no races or advanced techniques required.
• Privileges Required: Low (PR:L) — Requires a valid account with limited permissions.
• User Interaction: None (UI:N) — No victim interaction needed.
• Scope: Unchanged (S:U) — Impact confined to the vulnerable component.
• Confidentiality: None (C:N) — No data disclosure.
• Integrity: Low (I:L) — Limited modification of data or object attributes.
• Availability: None (A:N) — No denial of service.

Business Impact:

1. Audit Trail Corruption: Quality Management platforms are used to ensure regulatory compliance (e.g., financial services call-recording retention, healthcare patient-interaction recording). Tampering with conversation event createdBy attributes can corrupt audit trails, potentially violating compliance obligations.

2. Agent Evaluation Fraud: If the createdBy field anchors events to specific agent evaluations or scores, an attacker could modify attribution to unfairly lower/raise scores, impacting HR decisions and union/legal disputes in contact-center environments.

3. Evidence Integrity in Disputes: In disputes where recorded conversations serve as legal evidence, an attacker altering event metadata could challenge the authenticity of the underlying quality records.

Blast Radius: Restricted to a single vulnerable version (9.7.0) of Eleveo Quality Management. The low privilege requirement reduces external exploitability, but the vendor's complete failure to respond to disclosure raises concern: no patch timeline, no workaround, no acknowledgment. Enterprises running this version must assume the vulnerability remains exploitable indefinitely. The absence of CISA KEV listing indicates no known active exploitation by nation-state or high-profile threat actors at publication time, but public disclosure (per NVD description) elevates the risk of opportunistic exploitation.

EPSS: Not yet scored by FIRST.org; exploit likelihood data unavailable.

Detection Guidance

Detection of CWE-913 dynamic-attribute manipulation is challenging because the malformed request may appear structurally valid at layers that only inspect standard parameter presence. Detection should combine endpoint-specific anomaly detection, parameter value monitoring, and response-based heuristics. All rules below target the endpoint /enc-fwk-data/api/v3/conversations/ with focus on anomalous createdBy usage.

Sigma Rule

title: Eleveo Quality Management CVE-2026-85408 - Conversation Event createdBy Manipulation
id: 2a4c7e9f-1c3b-4d5e-8f9a-6b7c8d9e0f1a
status: experimental
description: Detects HTTP requests to the Eleveo Conversation Handler API events endpoint with anomalous or nested createdBy parameter values, indicating CVE-2026-85408 dynamic-attribute manipulation attempts.
logsource:
  category: webserver
  product: apache
  detection:
    selection_uri:
      cs-uri-query|contains|all:
        - '/enc-fwk-data/api/v3/conversations/'
        - '/events'
    selection_createdBy:
      cs-uri-query|contains:
        - 'createdBy[]='
        - 'createdBy['
        - 'createdBy={'
        - 'createdBy=__proto__'
        - 'createdBy=constructor'
        - 'createdBy=prototype'
        - 'createdBy=toString'
        - 'createdBy=valueOf'
    selection_method:
      cs-method:
        - 'POST'
        - 'PUT'
        - 'PATCH'
    condition: selection_uri and selection_createdBy and selection_method
  level: high
  falsepositives:
    - Legitimate administrative API usage modifying event attributes via nested payloads
    - Application-internal automation scripts using JSON payloads for createdBy
  fields:
    - clientip
    - cs-uri-query
  tags:
    - cve.2026-85408
    - attack.t1190
    - cwe.913

YARA Rule

rule Eleveo_CVE_2026_85408_createdBy_Manipulation {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payload patterns associated with CVE-2026-85408 dynamic attribute manipulation in Eleveo Quality Management conversation events"
        cve = "CVE-2026-85408"
        cwe = "CWE-913"
        date = "2026-02-15"
        severity = "medium"
    strings:
        $endpoint = "/enc-fwk-data/api/v3/conversations/" ascii wide nocase
        $events = "/events" ascii wide nocase
        $cb_flat = "createdBy=" ascii wide nocase
        $cb_array = "createdBy[]" ascii wide nocase
        $cb_nested = "createdBy[" ascii wide nocase
        $cb_json = "\"createdBy\"" ascii wide
        $proto = "__proto__" ascii wide nocase
        $constructor = "constructor" ascii wide nocase
        $prototype = "prototype" ascii wide nocase
    condition:
        (uint16(0) == 0x3C3C or // HTTP request data
         uint16(0) == 0x0D0A or  // HTTP response data
         filesize < 10MB) and
        any of ($endpoint, $events) and
        any of ($cb_flat, $cb_array, $cb_nested, $cb_json) and
        (any of ($proto, $constructor, $prototype) or #cb_array > 0 or #cb_nested > 0 or #cb_json > 0)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT Eleveo Quality Management CVE-2026-85408 createdBy Attribute Manipulation Attempt";
    flow:established,to_server;
    http.uri;
    content:"/enc-fwk-data/api/v3/conversations/";
    content:"/events";
    http.client_body;
    content:"createdBy";
    pcre:"/createdBy\s*[=:]\s*([\[{].*|.*(?:__proto__|constructor|prototype|toString|valueOf))/i";
    classtype:attempted-admin;
    sid:202685408;
    rev:1;
    metadata:created_at 2026_02_15, cve CVE-2026-85408, cwe CWE-913, mitre_tactic TA0001, mitre_technique T1190;
)

Note: $EXTERNAL_NET in this rule assumes low-privilege internal accounts connecting to externally exposed (or DMZ-hosted) Eleveo endpoints. Adjust destination network variable based on deployment architecture; the alert will also fire on internal client-to-server HTTP where alert http any any -> $HOME_NET any is more appropriate if the Eleveo instance is internal-only.

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "web" and network.protocol == "http" and
   http.request.method in ("POST", "PUT", "PATCH") and
   url.path like "*enc-fwk-data/api/v3/conversations*" and
   url.path like "*/events"
  ] by http.request.body
  [network where event.category == "web" and network.protocol == "http" and
   url.query like "createdBy*" or 
   url.query like "*createdBy%5B*" or
   url.query like "*createdBy%7B*" or
   url.query like "*__proto__*" or
   url.query like "*constructor*"
  ] by http.request.body

Note: This EQL rule should be supplemented with a threat.metadata lookup or a constant_keyword filter identifying the target host (Eleveo Quality Management server) to reduce noise. If http.request.body is populated for JSON POST bodies, the rule can also match on nested-body patterns via http.request.body.content — Elastic's HTTP fields may not capture raw bodies depending on ingest pipeline configuration.

Splunk SPL Query

index=web OR index=proxy 
  [search index=web OR index=proxy 
    | where like(uri_path, "%/enc-fwk-data/api/v3/conversations/%/events") 
    | stats count by src_ip] 
  | where like(uri_path, "%/enc-fwk-data/api/v3/conversations/%/events") 
  | rex field=uri_query max_match=0 "(?i)createdBy(?<cb_pattern>\[|%5B|\{|%7B|=)"
  | eval suspicious = case(
        like(uri_query, "%__proto__%"), "prototype-pollution",
        like(uri_query, "%constructor%"), "constructor-injection",
        like(uri_query, "%prototype%"), "prototype-injection",
        like(uri_query, "%toString%") OR like(uri_query, "%valueOf%"), "dword-access",
        isnotnull(cb_pattern), "nested-createdBy",
        1=1, "flat")
  | where suspicious != "flat"
  | table _time, src_ip, method, uri_path, uri_query, suspicious
  | sort -_time

Wazuh OSSEC Rule

<group name="eleveo,cve-2026-85408,">
  <rule id="991590" level="12">
    <if_sid>31100, 31101, 31102</if_sid>  <!-- Common web server rules for receiving requests -->
    <field name="url">\./enc-fwk-data/api/v3/conversations/.*/events</field>
    <regex>createdBy\s*(=|\()\s*(\[|\{|"|')</regex>
    <description>Possible CVE-2026-85408 exploitation attempt: nested/object createdBy value in Eleveo Conversation Handler API request</description>
    <group>attack,t1190,cwe-913,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="991591" level="14">
    <if_sid>10085408</if_sid>
    <regex>__proto__|constructor|prototype|toString|valueOf</regex>
    <description>Confirmed CVE-2026-85408 exploitation attempt: dangerous dynamic property keys in createdBy parameter</description>
    <group>attack,t1190,cwe-913,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: The parent SIDs (31100-31102) reference the standard OSSEC Apache web ruleset. Adjust if_sid to match your Wazuh deployment's existing web-access rules if the pre-defined SIDs differ.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor has not responded to disclosure. No fixed version exists at time of writing.

1. Immediate Mitigations (no patch available):

• Restrict API Access: If the Eleveo Quality Management web interface/API does not need to be reachable from broad network segments, apply strict firewall/security-group rules to limit access to /enc-fwk-data/ to only authorized administrative workstations or management VLANs.
• Enforce Strong Least-Privilege: Audit all accounts with API access. Ensure no user has more privileges than their job function requires — specifically limit who can access the conversation event endpoints. Revoke API credentials for former staff.
• Web Application Firewall (WAF) Rules: Deploy virtual-patch rules in front of the Eleveo application that block requests to /enc-fwk-data/api/v3/conversations/*/events containing createdBy values that are nested objects, arrays, or contain prototype/keyword strings (__proto__, constructor, prototype, toString, valueOf).
• Rate Limiting & Request Triage: Enable rate-limiting on the API endpoint to slow automated enumeration of conversation IDs.
• Enhanced Logging: Enable verbose request logging on the vulnerable endpoint to capture full URI and POST bodies (observe data-privacy constraints when logging conversation-related payloads). Forward these logs to your SIEM using the detection rules above.

2. Patch/Upgrade Steps:

• No vendor patch exists. Eleveo has not responded to the disclosure, so there is no advisory, patch, or version to upgrade to at this time.
• Action: Contact Eleveo support directly and open a ticket referencing CVE-2026-85408 and the public disclosure to force acknowledgement. Demand a remediation timeline and interim security bulletin.
• Monitor Eleveo's security advisory page and third-party CVE feeds (NVD, CISA) for a future fixed version designation. When a fixed version is released, test and deploy it in your change window — prioritizing any mention of patching the Conversation Handler module.

3. Long-Term Hardening:

• Vendor Accountability: If Eleveo continues to ignore security disclosures, consider this a significant supply-chain risk factor. Evaluate alternative Quality Management platforms or negotiate contractual vulnerability-response SLAs in your licensing agreement.
• Network Segmentation: Move the Eleveo Quality Management application (web front-end and API) into an internal management segment with strict source-IP allow-listing and MFA at the network edge. Apply Zero-Trust principles: no direct remote access, only via jump hosts.
• Periodic Security Reviews: Given the CWE-913 classification (dynamic object attribute control), request a professional penetration test focused on the API layer of your deployed version to identify additional similar flaws in sibling endpoints (e.g., other /enc-fwk-data/api/v3/ resources).
• Compliance Contingency: If conversation event data underpins regulatory compliance (FINRA, HIPAA, GDPR article 5(2) accountability), document the vulnerability and the lack of vendor response in your risk register. Assess whether alternate independent recording/archival of conversation events is needed as a compensating control to preserve evidence integrity.

References

1. NVD Entry — CVE-2026-85408: https://nvd.nist.gov/vuln/detail/CVE-2026-85408 — Official NVD record with CVSS v3.1 vector, CWE-913 classification, and the only substantive technical description available.
2. CWE-913 — Improper Control of Dynamically-Managed Code Resources: https://cwe.mitre.org/data/definitions/913.html — Weakness class reference providing definitional context for the vulnerability mechanism (dynamic object attribute resolution without control).
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Listed CVE-2026-85408 as NOT in the KEV catalog; monitor this source for updates given the public exploit disclosure referenced in NVD.
4. FIRST.org EPSS Feed: https://www.first.org/epss/ — CVE-2026-85408 not yet scored; subscribe for the first EPSS score publication to reassess exploitation likelihood.
5. Eleveo Corporate Site / Advisory Page: https://www.eleveo.com/ — Monitor for any future security advisories; as of analysis date, vendor has not published an advisory nor responded to the reporter.

Threat Actor / Exploit-in-the-Wild Evidence: No named threat actor campaigns are associated with CVE-2026-85408. The NVD description confirms the exploit has been publicly disclosed, which elevates risk of opportunistic exploitation — particularly by insider threat actors with low-privilege access or external parties able to compromise low-privilege accounts. No CISA KEV inclusion, no Metasploit/Exploit-DB entries confirmed at publication time.