Read the docs
TI-2026-12075 Aliases CVE-2026-14261GHSA-3g88-3v3g-pch4

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote…

Priority MEDIUM 49Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01035 64th percentileScored 2026-11-07
Fix Fixed Xerte Online Tools (Xerte): 3.14.6, 3.15.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XerteXerte Online Toolsbefore 3.14.63.14.6Patch availableCNA
XerteXerte Online Toolsbefore 3.15.53.15.5Patch availableCNA
  • Xerte Online Tools VendorXerte Affected before 3.14.6 Fixed in 3.14.6 Patch available CNA
  • Xerte Online Tools VendorXerte Affected before 3.15.5 Fixed in 3.15.5 Patch available CNA

Remediation

  • Fix · CNA Xerte Online Tools (Xerte) Fixed in 3.14.6
  • Fix · CNA Xerte Online Tools (Xerte) Fixed in 3.15.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xerte Online Tools 3.14.6

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-10434 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary…Priority MEDIUM 50
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14261
  2. 2026-10-03 Alias added: GHSA-3g88-3v3g-pch4

References

Other 3

  • TI-2026-25433 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2021-20196 An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in… CVSS 3.1HIGH 8.8
  • TI-2026-10434 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary… CVSS 3.1CRITICAL 9.8
  • TI-2021-20197 A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences