CVE-2026-94387

Executive Summary

CVE-2026-94387 is a stored cross-site scripting (XSS) vulnerability in Aureus ERP versions before 1.6.0, residing in the Chatter field-change log where historical old_value and new_value entries are rendered without proper output escaping. Any authenticated user with permission to edit tracked text fields can persist a malicious markup payload that executes in the browser of other users—including administrators—when they open the affected record's Chatter panel. With a CVSS base score of 5.4 and a scope change (S:C), the flaw enables session-riding and privileged action execution in the context of higher-privileged victims, though exploitation requires user interaction and a low-privileged authenticated foothold.

Technical Analysis

The vulnerability class is persistent (stored) cross-site scripting, mapped to CWE-79. The affected component is the Chatter field-change log within Aureus ERP, an activity/audit feed that records modifications to tracked fields. According to the NVD description, the mechanism is an output-encoding failure: when a tracked text field is modified, the system captures the prior value (old_value) and the new value (new_value) and later renders both entries inside a user's Chatter panel. Because these values are emitted without proper escaping, an attacker-controlled string supplied through a legitimate field edit is stored verbatim and reinterpreted as markup/script when the panel is displayed to other users.

The attack surface is the authenticated application interface that permits editing of "tracked text fields." The precondition is that a field must be under change tracking so that its previous and current values are written into the Chatter log. Once written, the malicious content is persisted in the application's data store (making this stored, not reflected) and is delivered to every user who views the record's Chatter panel. No endpoint names, parameter names, or code symbols beyond old_value, new_value, and "Chatter" are specified in the available description, so the precise request/route used to inject is not derivable and is not asserted here.

From a CVSS perspective, the vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates: network-deliverable, low attack complexity, low privileges required (the editor role), user interaction required (a victim must view the panel), a scope change (impact crosses a trust boundary from the low-privileged editor to the higher-privileged viewer), low confidentiality and integrity impact, and no availability impact. The scope change is the key qualitative risk: the attacker's injected content acts with the victim's privileges, not the attacker's, which is why an administrator viewing the log is the high-value target despite the initial low-privilege foothold.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available. The following chain is inferred exclusively from the described vulnerability class (stored XSS) and the specific rendering context (old_value/new_value in the Chatter log). No implementation specifics are fabricated.

1. Reconnaissance / target identification. The attacker obtains an authenticated account in the Aureus ERP instance and identifies fields that are under change tracking and whose history surfaces in the Chatter panel. Targeting favors fields edited by privileged personnel, since their modifications later appear to administrators. The attacker confirms (out of band) that the deployment predates 1.6.0.

2. Triggering the flaw. Using the account's edit permission on a tracked text field, the attacker sets the field's new_value to a crafted string containing markup/script. On the next modification, the prior content is logged as old_value. Because neither value is escaped before being written into or rendered from the Chatter field-change log, the payload is stored. This is a single, ordinary field edit—no exploit primitive beyond normal application functionality is required, consistent with PR:L.

3. Payload / execution (class level). The stored markup is rendered in the victim's browser when the victim opens the record's Chatter panel. At the vulnerability-class level, execution occurs in the origin/security context of the ERP application and under the victim's session. The attacker's delivery mechanism is passive: the payload fires on view (UI:R). Because of S:C, the script is not confined to the attacker's low-privilege context.

4. Post-exploitation impact. With execution in an administrator's session, the attacker can perform privileged actions through the victim's authenticated session and read data visible to that user (C:L/I:L). Typical consequences for this class include session token theft/session riding, modification of records, and pivoting to administrative functions. Availability is unaffected (A:N). The absence of public exploit tooling lowers immediate large-scale automation risk but does not neutralize the flaw.

Impact Assessment

Business impact centers on privilege escalation through a trusted application surface. The S:C scope change means the injected script operates beyond the attacker's authorization boundary, enabling actions as the viewing user. In an ERP context, administrators handle configuration, financial, HR, and access-control data; compromise of an admin session can translate into unauthorized data disclosure, fraudulent record changes, and lateral movement within the ERP. Blast radius is every user who views an affected record's Chatter panel, scaling with how broadly tracked fields are used. CVSS subscores — C:L (limited confidentiality), I:L (limited integrity), A:N (no availability impact) — indicate bounded per-event impact, but the persistent, admin-view-triggered nature elevates real-world severity above the 5.4 base in high-value deployments. No EPSS score is available (not yet scored by FIRST.org), and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Suspicious Script Markup in Aureus ERP Chatter Field-Change Log
id: 3f9a1c72-5b64-4e21-9c0a-aureus94387
status: experimental
description: Detects storage of HTML/script markup into tracked field values that surface in the Chatter field-change log (CVE-2026-94387)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94387
logsource:
  product: aureus_erp
  category: application
detection:
  selection_keywords:
    - '<script'
    - 'javascript:'
    - 'onerror='
    - 'onload='
    - '<svg'
    - '<img'
  selection_fields:
    - old_value
    - new_value
  condition: selection_fields and selection_keywords
fields:
  - user
  - record_id
  - field_name
  - old_value
  - new_value
falsepositives:
  - Legitimate documentation fields intentionally storing HTML
level: high

YARA Rule

rule CVE_2026_94387_Aureus_Chatter_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects stored XSS payloads in Aureus ERP Chatter field-change log old_value/new_value (CVE-2026-94387)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94387"
        cve = "CVE-2026-94387"
    strings:
        $tag_script = "<script" ascii nocase
        $js_scheme   = "javascript:" ascii nocase
        $ev_onerror  = "onerror=" ascii nocase
        $ev_onload   = "onload=" ascii nocase
        $svg_tag     = "<svg" ascii nocase
        $img_tag     = "<img" ascii nocase
        $fld_old     = "old_value" ascii nocase
        $fld_new     = "new_value" ascii nocase
        $chatter     = "Chatter" ascii nocase
    condition:
        (any of ($tag_script, $js_scheme, $ev_onerror, $ev_onload, $svg_tag, $img_tag)) and
        (any of ($fld_old, $fld_new)) and
        filesize < 5MB
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-94387 Aureus ERP Chatter Stored XSS Payload in Field Edit"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a|"; pcre:"/(old_value|new_value)=[^&]*(%3Cscript|<script|javascript%3A|onerror%3D|onload%3D)/i"; classtype:web-application-attack; reference:cve,2026-94387; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94387; sid:9438701; rev:1;)

Elastic Detection

sequence by user.name, process.entity_id with maxspan=1m
  [any where event.category == "web" and url.path : "*" and
     (http.request.body.content : "*<script*" or http.request.body.content : "*javascript:*"
      or http.request.body.content : "*onerror=*" or http.request.body.content : "*onload=*")]
  [any where event.category == "web" and
     (http.response.body.content : "*<script*" or http.response.body.content : "*javascript:*")]

Splunk SPL Query

index=web OR index=erp sourcetype=aureus:app
| eval body=lower(coalesce(http_request_body, request_body, old_value, new_value, ""))
| where match(body, "(<script|javascript:|onerror=|onload=|<svg|<img)")
| stats count values(user) as actors values(uri_path) as paths by src, dest
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="aureus_erp,web,attack,">
  <rule id="943870" level="12">
    <decoded_as>json</decoded_as>
    <field name="old_value">\.*(\x3cscript|javascript:|onerror=|onload=|\x3csvg|\x3cimg)\.*</field>
    <description>CVE-2026-94387: Possible stored XSS payload written to Aureus ERP Chatter old_value field</description>
    <mitre>
      <id>T1059</id>
      <id>T1189</id>
    </mitre>
  </rule>
  <rule id="943871" level="12">
    <decoded_as>json</decoded_as>
    <field name="new_value">\.*(\x3cscript|javascript:|onerror=|onload=|\x3csvg|\x3cimg)\.*</field>
    <description>CVE-2026-94387: Possible stored XSS payload written to Aureus ERP Chatter new_value field</description>
    <mitre>
      <id>T1059</id>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Until version 1.6.0 or a vendor fix is confirmed, restrict who can edit tracked text fields to trusted roles. Audit existing Chatter field-change logs for stored markup in old_value/new_value entries and sanitize or purge suspicious records. Enforce output encoding at the rendering layer if the deployment permits, and deploy a strict Content Security Policy to reduce script execution in the ERP origin. Treat the Chatter panel as untrusted-render content in compensating WAF/edge rules.

2. Patch/upgrade steps. NVD identifies 1.6.0 as the version boundary at which the flaw is addressed. Verify the deployed version, back up data, and upgrade to 1.6.0 or later. Because no patch artifacts are tracked (Patch Sources empty, Vendor Fix N/A), validate the fix against the vendor before relying on it, and re-test the field-change log rendering after upgrade.

3. Long-term hardening. Adopt consistent output encoding for all user-supplied values, particularly historical/audit fields such as old_value and new_value. Apply least privilege to field-edit permissions, add sanitization for tracked fields, and integrate XSS regression testing into the release pipeline. Monitor for stored markup in log/audit surfaces as a standing detection use case.

References

• NVD — CVE-2026-94387: https://nvd.nist.gov/vuln/detail/CVE-2026-94387
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA Known Exploited Vulnerabilities Catalog (verify current listing status — CVE-2026-94387 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild campaign evidence is associated with CVE-2026-94387 in the available data.