---
cve: "CVE-2026-85407"
severity: "MEDIUM"
cvss: 5.3
epss: "0.5%"
vendor: "Eleveo"
kev: false
exploited: false
published: "2026-09-04 04:00:12"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T13:32:12+02:00"
---

# CVE-2026-85407

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /enc-fwk-data/api/v3/conversations//events of the component Conversation Handler. The manipulation of the argument labels results in denial of service. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulDB**
- State: PUBLISHED
- Stand: 2026-10-20 21:33:52
- CNA-CVSS: **5.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-404** — Improper Resource Shutdown or Release
  The product does not release or incorrectly releases a resource before it is made available for re-use.

## Angriffsmuster (CAPEC)

- [CAPEC-125 — Flooding](https://capec.mitre.org/data/definitions/125.html) _(Severity: Medium)_
- [CAPEC-130 — Excessive Allocation](https://capec.mitre.org/data/definitions/130.html) _(Severity: Medium)_
- [CAPEC-131 — Resource Leak Exposure](https://capec.mitre.org/data/definitions/131.html) _(Severity: Medium)_
- [CAPEC-494 — TCP Fragmentation](https://capec.mitre.org/data/definitions/494.html)
- [CAPEC-495 — UDP Fragmentation](https://capec.mitre.org/data/definitions/495.html)
- [CAPEC-496 — ICMP Fragmentation](https://capec.mitre.org/data/definitions/496.html)
- [CAPEC-666 — BlueSmacking](https://capec.mitre.org/data/definitions/666.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1498.001 — Network Denial of Service: Direct Network Flood](https://attack.mitre.org/techniques/T1498/001/)
- [T1499 — Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/)
- [T1499.003 — Endpoint Denial of Service:Application Exhaustion Flood](https://attack.mitre.org/techniques/T1499/003/)
- [T1499.001 — Endpoint Denial of Service: OS Exhaustion Flood](https://attack.mitre.org/techniques/T1499/001/)

## Referenzen

- <https://vuldb.com/vuln/398557>
- <https://vuldb.com/vuln/398557/cti>
- <https://vuldb.com/cve/CVE-2026-85407>
- <https://vuldb.com/submit/894902>
- <https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-85407>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-85407/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_