CVE-2026-12116
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in Xerte Online Tools allows remote code execution (RCE) by changing the antivirus binary path in the server settings to a PHP interpreter. An attacker can then upload PHP data that will be executed on the server.
Risk Assessment
The risk for the organization includes full server compromise, data theft, or use of the server for further attacks, as the attacker can execute arbitrary PHP code.
Recommendation
It is recommended to immediately update Xerte Online Tools to the latest version and restrict access to server settings to trusted administrators only.
Original NVD description (English source)
A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed.