High severity · published Oct 27, 2026
CVE-2026-117494
Multiple vulnerabilities in Sisense’s Cloud BI Platform
New
8.3
CVSS
0.4%
EPSS
No
On KEV
Description
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
Cloud BI Platform · Sisense
before 27/10/2026 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117494
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform
More from Cloud BI Platform
8.3
CVE-2026-117493
Multiple vulnerabilities in Sisense’s Cloud BI Platform