This vulnerability arises from insufficient validation of file contents during upload in the Lite Agent component of Cisco Enterprise Chat and Email. An authenticated attacker with Agent privileges can upload a file containing malicious scripts or HTML. The application then makes this file available to other users, and when viewed, the file’s contents execute in the victim’s browser, enabling attacker‑controlled browser-based attacks.

The affected product is Cisco Enterprise Chat and Email (ECE), specifically the Lite Agent feature. Users with at least the Agent role are required for exploitation. No specific version range is disclosed in the advisory.

The advisory assigns a CVSS score of 4.3, indicating a low‑to‑medium severity. Exploitation requires valid credentials and user interaction to open the uploaded file, reducing the likelihood of widespread automated attacks. However, because the payload runs in the victim’s browser, the attack can lead to data theft, session hijacking, or further network compromise. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation so far.