CVE-2026-14933

What it is

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-07-07 10:56 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-10-20 12:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-10-20 19:28 UTC Last updatedMost recent change to the record

Details

Published

2026-10-20 12:17 UTC

Last modified

2026-10-20 19:28 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Deferred

Attack profile CVSS 4.0 · 8.6

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

High

Integrity

High

Availability

None