CVE-2026-14933
HighCVSS 8.6Summary
In the embedded co-browsing feature in Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 (on-premises and cloud), an unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session, via content rendered as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a session with the attacker; mobile co-apping is not affected.
Risk Assessment
An attacker can hijack the agent's session and perform actions on their behalf, potentially leading to data leakage or unauthorized operations. It requires agent interaction, but the risk is high due to the privileged context.
Recommendation
Upgrade Unblu Spark to a version later than 7.57.7 or 8.39.2. Additionally, train agents not to join co-browsing sessions with unknown users.
Other vulnerabilities in Unblu Spark
See all- CVE-2026-9589Critical
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments. An authenticated remote attacker can read and change configuration properties of entities they aren't authorized to access, including other users, accounts, and in Unblu Cloud other customers' accounts.
- CVE-2026-8152Critical
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based XSS attack. When deployed with a specific configuration, it runs in the same origin as the host application, allowing an attacker full access to its resources.
Original NVD description (English source)
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS