CVE-2026-3014

CriticalCVSS 9.1

Published: 14/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

47th percentile - higher than 47% of all known CVEs

Summary

A vulnerability in the Management Server API of XProtect allows users with edit permissions to execute arbitrary code in the context of the Management Server Service.

Risk Assessment

An attacker with edit permissions could take over the management server, compromising the confidentiality, integrity, and availability of the surveillance system.

Recommendation

Immediately update XProtect to the latest version and apply all available cumulative patches.

Original NVD description (English source)

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.