CVE-2026-112197

CriticalCVSS 9.4

Published: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Risk Assessment

This vulnerability enables full compromise of the database server and operating system, leading to breach of confidentiality, integrity, and availability of critical organizational assets.

Recommendation

Immediately restrict network access to the Java RMI service and implement authentication and authorization for remote invocations. Update the application to a patched version.

Other vulnerabilities in NoviGest Desktop App

CVE-2026-112198High
The NoviGest Desktop App contains an XML External Entity (XXE) injection vulnerability in the SAFT import feature. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker could provide a manipulated XML file to read local files accessible to the application process.

Original NVD description (English source)

Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS