CVE-2026-112197
Tactis NoviGest Desktop App
- Tactis NoviGest Desktop App
- Critical
- CVSS 9.4
- No fixed version listed
Summary
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL.
From the CVE record.
Read the original description
CVE record
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
What to do
No fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Tactis NoviGest Desktop App | NoviGest Desktop App prior to version 8.0.0-300 | None listed |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0, scored by INCIBE)
- Weakness
- CWE-306: Missing authentication for critical function
- Vendor
- Tactis, NoviGest Desktop App
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.