Read the docs
TI-2026-10434 Aliases CVE-2026-12116GHSA-338w-wpc4-3pf4

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary…

Priority MEDIUM 50Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed Xerte Online Tools (Xerte): v3.15.5, 3.14.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XerteXerte Online Toolsbefore v3.15.5v3.15.5Patch availableCNA
XerteXerte Online Toolsbefore 3.14.63.14.6Patch availableCNA
  • Xerte Online Tools VendorXerte Affected before v3.15.5 Fixed in v3.15.5 Patch available CNA
  • Xerte Online Tools VendorXerte Affected before 3.14.6 Fixed in 3.14.6 Patch available CNA

Remediation

  • Fix · CNA Xerte Online Tools (Xerte) Fixed in v3.15.5
  • Fix · CNA Xerte Online Tools (Xerte) Fixed in 3.14.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xerte Online Tools 3.14.6

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-12075 A vulnerability in the Xerte Online Tools allows for authentication bypass and remote…Priority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12116
  2. 2026-10-03 Alias added: GHSA-338w-wpc4-3pf4

References

Other 3

  • TI-2026-25433 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2021-20196 An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in… CVSS 3.1HIGH 8.8
  • TI-2026-12075 A vulnerability in the Xerte Online Tools allows for authentication bypass and remote… CVSS 3.1CRITICAL 9.1
  • TI-2021-20197 A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences