Key points
- CVE-2026-14933 affects Unblu Spark versions 7.0 through 7.57.7 and 8.0 through 8.39.2.
- The flaw allows arbitrary JavaScript execution in the context of an agent's session.
- Exploitation requires an agent to join a co-browsing session with a malicious visitor.
A high-severity cross-site scripting vulnerability in Unblu Spark enables unauthenticated attackers to execute arbitrary JavaScript within the browsers of support agents. The flaw, tracked as CVE-2026-14933, impacts both on-premises and cloud deployments of the customer engagement platform.
According to the National Vulnerability Database, the issue resides in the embedded co-browsing feature. An attacker acting as a visitor can inject malicious content into the co-browsed page. When an agent joins the session, their browser renders this content as HTML, triggering the script execution.
Context and Background
The executed JavaScript runs under the identity and context of the agent’s active session. This applies to agents using either the Agent Desk or the Single Conversation Desk interfaces. The vulnerability is rated 8.6 on the CVSS scale, placing it in the high severity category.
The weakness is classified under CWE-79, indicating a failure to properly neutralize user-controllable input before placing it in a web page. This allows the injected code to be rendered as HTML by the agent's browser.
Who Is Affected
Unblu Spark versions 7.0 through 7.57.7 are vulnerable to this exploit. Additionally, versions 8.0 through 8.39.2 are also affected. The vulnerability exists in both on-premises installations and cloud-hosted deployments of the software.
Mobile co-browsing sessions are not affected by this specific vulnerability. The flaw only impacts standard desktop or web-based co-browsing interactions where the agent's browser renders the shared page content.
Next steps
Organizations using affected versions of Unblu Spark should assess their exposure immediately. Teams must evaluate the risk of unauthenticated visitors initiating co-browsing sessions.
Administrators should review access controls for the co-browsing feature. Limiting who can initiate these sessions may reduce the attack surface.
Signals worth monitoring
Security teams should monitor for anomalous JavaScript execution within agent browser sessions. Check logs for unexpected redirects or data exfiltration attempts originating from co-browsing interfaces. Look for unusual API calls made from the agent's context that differ from standard support workflows. Verify that agent sessions are not being used to access unauthorized resources or modify settings. Investigate any sudden changes in session behavior or unexplained cookie modifications during active support interactions.
What to do and how to stay safe: Unblu Spark
- Audit current Unblu Spark versions to determine if they fall within the affected ranges of 7.0-7.57.7 or 8.0-8.39.2.
- Review logs for suspicious activity in agent browsers, specifically looking for unauthorized script execution during co-browsing sessions.
- Restrict the ability of unauthenticated visitors to initiate co-browsing sessions if possible.
- Monitor for any vendor announcements regarding patches or mitigations for CVE-2026-14933.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Unblu Spark are vulnerable to CVE-2026-14933?
Versions 7.0 through 7.57.7 and 8.0 through 8.39.2 are affected.
Can this vulnerability be exploited remotely?
Yes, an unauthenticated remote attacker in the visitor role can exploit this flaw.
Is mobile co-browsing affected by this vulnerability?
No, the source material states that mobile co-browsing is not affected.
