Is CVE-2026-97179 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97179 being exploited in the wild.

How severe is CVE-2026-97179?

Medium severity, with a CVSS score of 4.3, published 24 September 2026.

Which products and versions are affected?

O2OA 9.5 through 10.0.2-ce (specifically 9.5, 9.5.1, 9.5.2, 9.5.3, 10.0-ce, 10.0.1-ce, 10.0.2-ce).

Is there a fix for CVE-2026-97179?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97179 attacked?

It is attacked over the network.

Am I affected by CVE-2026-97179?

Check whether you run O2OA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97179: O2OA CipherConnectionAction credential exposure

CVE-2026-97179 · Severity: medium · CVSS 4.3 · Published 2026-09-24

O2OA, a workflow automation platform, contains a flaw where administrative security credentials (cipher tokens) are automatically attached to all outbound web requests, regardless of destination. An attacker with basic user account access can manipulate the file upload endpoint to send requests to a server they control, capturing the highest-privilege credentials. These credentials can then be used to take complete control of the O2OA system, bypassing all access controls.

Technologies: O2OA. Vendors: O2OA.

Quick answers

Is CVE-2026-97179 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97179 being exploited in the wild.
How severe is CVE-2026-97179?: Medium severity, with a CVSS score of 4.3, published 24 September 2026.
Which products and versions are affected?: O2OA 9.5 through 10.0.2-ce (specifically 9.5, 9.5.1, 9.5.2, 9.5.3, 10.0-ce, 10.0.1-ce, 10.0.2-ce).
Is there a fix for CVE-2026-97179?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97179 attacked?: It is attacked over the network.
Am I affected by CVE-2026-97179?: Check whether you run O2OA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The CipherConnectionAction.getBinary() method unconditionally attaches system-level cipher credentials to all HTTP requests via the cipher() function, violating least-privilege principles. The /excel/upload/with/url endpoint in x_general_assemble_control allows any authenticated user to specify an arbitrary target URL, enabling Server-Side Request Forgery (SSRF) with credential leakage. An attacker can extract the cipher token and escalate privileges from regular user to system administrative level.

Affected products

O2OA O2OA 9.5 through 10.0.2-ce (specifically 9.5, 9.5.1, 9.5.2, 9.5.3, 10.0-ce, 10.0.1-ce, 10.0.2-ce)

Timeline

2026-09-24: disclosed: Publicly disclosed on GitHub
2025-09-30: other: Vulnerable code path introduced in ActionUploadExcelWithUrl.java

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.