CVE-2026-14261
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability in Xerte Online Tools allows authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to take over the service and connect it to a remote database they control.
Risk Assessment
The risk for the organization includes full system compromise, data theft, and potential use of the service for further attacks on IT infrastructure.
Recommendation
It is recommended to immediately remove or secure the /setup/ folder and update Xerte Online Tools to the latest patched version.
Original NVD description (English source)
A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.