A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Six years. Gartner® Magic Quadrant™ Leader.Find Out Why
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2026-22587

CVE-2026-22587: Ideagen DevonWay Stored XSS Vulnerability

CVE-2026-22587 is a stored XSS vulnerability in Ideagen DevonWay that allows authenticated attackers to inject malicious scripts via the Reports page. This article covers technical details, affected versions, and mitigation.

Updated: January 22, 2026

CVE-2026-22587 Overview

CVE-2026-22587 is a stored cross-site scripting (XSS) vulnerability affecting Ideagen DevonWay. A remote, authenticated attacker can craft a malicious payload in the 'Reports' page that executes arbitrary JavaScript code when another user views the report. This type of vulnerability allows attackers to persist malicious scripts within the application, potentially compromising user sessions, stealing sensitive data, or performing unauthorized actions on behalf of victims.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, and unauthorized actions within the DevonWay platform.

Affected Products

  • Ideagen DevonWay versions prior to 2.62.4
  • Ideagen DevonWay versions prior to 2.62 LTS

Discovery Timeline

  • January 8, 2026 - CVE-2026-22587 published to NVD
  • January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22587

Vulnerability Analysis

This stored cross-site scripting vulnerability (CWE-79) exists in the Ideagen DevonWay application's Reports functionality. The vulnerability allows authenticated users to inject malicious JavaScript payloads that are stored persistently within the application. When other users access the affected report, the malicious script executes within their browser context, inheriting their session privileges and access rights.

The attack requires the attacker to have authenticated access to the DevonWay platform with sufficient permissions to create or modify reports. Once the payload is stored, it remains active until explicitly removed, making it particularly dangerous as it can affect multiple users over time without requiring continued attacker interaction.

Root Cause

The root cause of CVE-2026-22587 is insufficient input sanitization and output encoding in the Reports page functionality. User-supplied input is not properly validated or escaped before being stored in the database and subsequently rendered in other users' browsers. This allows specially crafted HTML and JavaScript content to be interpreted as executable code rather than being displayed as harmless text.

Attack Vector

The attack is conducted over the network by an authenticated user. The attacker creates or modifies a report within the DevonWay application, embedding malicious JavaScript code in vulnerable input fields. When other users navigate to view the compromised report, the stored payload executes in their browser session. This can be leveraged to steal session cookies, redirect users to malicious sites, modify page content, or perform actions as the victim user.

The vulnerability is exploitable through the application's web interface, requiring only standard browser access and valid user credentials. The payload persists across page loads and user sessions, maximizing the potential impact.

Detection Methods for CVE-2026-22587

Indicators of Compromise

  • Unexpected JavaScript code or HTML tags present in report content or database fields
  • Anomalous report modifications by users who typically don't edit reports
  • Browser-based alerts or redirects occurring when users access the Reports page
  • Session cookie theft indicators such as unauthorized access from new IP addresses

Detection Strategies

  • Implement web application firewall (WAF) rules to detect common XSS patterns in HTTP requests
  • Monitor application logs for suspicious characters or script tags in report-related requests
  • Deploy Content Security Policy (CSP) headers to detect and block inline script execution
  • Review report content periodically for unexpected HTML or JavaScript artifacts

Monitoring Recommendations

  • Enable detailed logging for all report creation and modification activities
  • Configure alerting for CSP violation reports that may indicate XSS attempts
  • Monitor user session patterns for signs of session hijacking following report access
  • Implement real-time scanning of user-generated content for malicious payloads

How to Mitigate CVE-2026-22587

Immediate Actions Required

  • Upgrade Ideagen DevonWay to version 2.62.4 or 2.62 LTS immediately
  • Audit existing reports for suspicious or malicious content
  • Review user access logs for potential exploitation attempts
  • Implement or strengthen Content Security Policy headers as a defense-in-depth measure

Patch Information

Ideagen has released security patches addressing this vulnerability in DevonWay versions 2.62.4 and 2.62 LTS. Organizations should prioritize updating to these fixed versions. For additional details, consult the CISA CSAF Document or the official CVE.org record.

Workarounds

  • Restrict report creation and modification privileges to trusted users only until patching is complete
  • Implement additional input validation at the web server or WAF level to filter potential XSS payloads
  • Deploy strict Content Security Policy headers to prevent inline script execution
  • Consider temporarily disabling user-generated report functionality if the risk is deemed unacceptable

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeXSS

  • Vendor/TechIdeagen

  • SeverityMEDIUM

  • CVSS Score4.8

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityLow
  • CWE References
  • CWE-79
  • Technical References
  • CISA CSAF Document

  • CVE.org Record for CVE-2026-22587
  • Latest CVEs
  • CVE-2026-50263: X.org X Server Use-After-Free Flaw

  • CVE-2026-21033: Samsung Assistant RCE Vulnerability

  • CVE-2026-21032: Samsung Assistant RCE Vulnerability

  • CVE-2026-50260: X.org X Server Use-After-Free Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English