CVE-2026-112197
Received Received - Intake

Authentication Bypass in NoviGest Desktop App Leads to RCE

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-112197
EUVD
EUVD-2026-111991

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Tactis NoviGest Desktop App NoviGest Desktop App prior to version 8.0.0-300

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112197 is a critical vulnerability in the NoviGest Desktop App's Java RMI service due to missing authentication in critical functions. An attacker with network access can remotely invoke methods without authentication, steal sensitive credentials, execute arbitrary SQL queries on the PostgreSQL database, and run operating system commands on the server.

Detection Guidance

To detect this vulnerability, scan for open Java RMI service ports (typically 1099) on your network. Check if the NoviGest Desktop App version 7.4.4-292 is running and if the RMI interface is exposed. Use network scanners like nmap to identify the service and verify if it allows unauthenticated method invocations.

Impact Analysis

This vulnerability allows attackers to gain full control over the server hosting the NoviGest Desktop App. They can steal sensitive data, manipulate databases, and execute malicious commands, leading to data breaches, system compromise, and potential disruption of services.

Compliance Impact

This vulnerability can lead to severe compliance violations under GDPR and HIPAA due to unauthorized access to sensitive data, potential data breaches, and lack of proper authentication controls. Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade to NoviGest Desktop App version 8.0.0-300 or later, which removes exposed interfaces and enforces authentication. If upgrading is not possible, restrict network access to the Java RMI service using firewalls and disable unnecessary RMI interfaces. Review PostgreSQL account privileges to ensure they are minimal and not elevated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart